@ouro.bot/cli 0.1.0-alpha.682 → 0.1.0-alpha.684

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.684",
+      "changes": [
+        "Bootstrap private-runtime provider credentials before queued work is flushed."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.683",
+      "changes": [
+        "Apply daemon credential bootstrap IPC buffered before the private-runtime credential waiter attaches."
+      ]
+    },
     {
       "version": "0.1.0-alpha.682",
       "changes": [

package/dist/heart/agent-entry.js

@@ -36,21 +36,24 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // Unified agent runtime entrypoint.
 // Requires --agent before importing runtime modules that rely on identity.
 const agentArgIndex = process.argv.indexOf("--agent");
-const agentName = agentArgIndex >= 0 ? process.argv[agentArgIndex + 1] : undefined;
-if (!agentName) {
+const parsedAgentName = agentArgIndex >= 0 ? process.argv[agentArgIndex + 1] : undefined;
+if (!parsedAgentName) {
     // eslint-disable-next-line no-console -- pre-boot guard
     console.error("Missing required --agent <name> argument.\nUsage: node dist/heart/agent-entry.js --agent ouroboros");
     process.exit(1);
 }
+const agentName = parsedAgentName;
 const cli_logging_1 = require("../nerves/cli-logging");
 const runtime_1 = require("../nerves/runtime");
 (0, cli_logging_1.configureCliRuntimeLogger)("self");
 const ipcStateKey = Symbol.for("ouro.agentEntry.ipcState");
 const ipcState = (globalThis[ipcStateKey] ??= {
+    bufferedRuntimeCredentialMessages: [],
     bufferedMessages: [],
     installed: false,
     workerMessageHandler: null,
 });
+ipcState.bufferedRuntimeCredentialMessages = [];
 ipcState.bufferedMessages = [];
 ipcState.workerMessageHandler = null;
 function isRuntimeCredentialBootstrapMessage(message) {
@@ -59,6 +62,24 @@ function isRuntimeCredentialBootstrapMessage(message) {
         && !Array.isArray(message)
         && message.type === "ouro.runtimeCredentialBootstrap";
 }
+function isRuntimeCredentialBootstrapForAgent(message, expectedAgentName) {
+    return isRuntimeCredentialBootstrapMessage(message)
+        && message.agentName === expectedAgentName;
+}
+function drainBufferedRuntimeCredentialBootstrap(applyRuntimeCredentialBootstrapMessage) {
+    let bootstrapped = false;
+    const remainingMessages = [];
+    for (const message of ipcState.bufferedRuntimeCredentialMessages.splice(0)) {
+        if (isRuntimeCredentialBootstrapForAgent(message, agentName)) {
+            bootstrapped = applyRuntimeCredentialBootstrapMessage(message) || bootstrapped;
+        }
+        else {
+            remainingMessages.push(message);
+        }
+    }
+    ipcState.bufferedRuntimeCredentialMessages.push(...remainingMessages);
+    return bootstrapped;
+}
 function isPrivateRuntimeWorkMessage(message) {
     if (!message || typeof message !== "object" || Array.isArray(message))
         return false;
@@ -72,8 +93,10 @@ function isPrivateRuntimeWorkMessage(message) {
         || type === "message";
 }
 function forwardOrBufferRuntimeMessage(message) {
-    if (isRuntimeCredentialBootstrapMessage(message))
+    if (isRuntimeCredentialBootstrapMessage(message)) {
+        ipcState.bufferedRuntimeCredentialMessages.push(message);
         return;
+    }
     if (!isPrivateRuntimeWorkMessage(message))
         return;
     if (ipcState.workerMessageHandler) {
@@ -98,11 +121,23 @@ if (!ipcState.installed) {
 });
 // Dynamic import: agent-entry is process-start wiring that starts a sense process.
 // Using dynamic import avoids a static heart/ -> senses/ dependency.
-Promise.resolve().then(() => __importStar(require("./runtime-credentials"))).then(async ({ readMachineRuntimeCredentialConfig, readRuntimeCredentialConfig, refreshMachineRuntimeCredentialConfig, refreshRuntimeCredentialConfig, waitForRuntimeCredentialBootstrap, }) => {
-    await waitForRuntimeCredentialBootstrap(agentName);
+Promise.resolve().then(() => __importStar(require("./runtime-credentials"))).then(async ({ readMachineRuntimeCredentialConfig, readRuntimeCredentialConfig, refreshMachineRuntimeCredentialConfig, refreshRuntimeCredentialConfig, applyRuntimeCredentialBootstrapMessage, waitForRuntimeCredentialBootstrap, }) => {
+    const { readProviderCredentialPool, refreshProviderCredentialPool } = await Promise.resolve().then(() => __importStar(require("./provider-credentials")));
+    const bootstrappedBeforeWait = drainBufferedRuntimeCredentialBootstrap(applyRuntimeCredentialBootstrapMessage);
+    const bootstrappedDuringWait = bootstrappedBeforeWait ? true : await waitForRuntimeCredentialBootstrap(agentName);
+    if (bootstrappedDuringWait) {
+        ipcState.bufferedRuntimeCredentialMessages = ipcState.bufferedRuntimeCredentialMessages.filter((message) => !isRuntimeCredentialBootstrapForAgent(message, agentName));
+    }
+    else {
+        drainBufferedRuntimeCredentialBootstrap(applyRuntimeCredentialBootstrapMessage);
+    }
     if (!readRuntimeCredentialConfig(agentName).ok) {
         void refreshRuntimeCredentialConfig(agentName, { preserveCachedOnFailure: true }).catch(() => undefined);
     }
+    const providerPool = readProviderCredentialPool(agentName);
+    if (!providerPool.ok || Object.keys(providerPool.pool.providers).length === 0) {
+        await refreshProviderCredentialPool(agentName, { preserveCachedOnFailure: true }).catch(() => undefined);
+    }
     /* v8 ignore next 7 -- process-start best-effort machine credential refresh runs in a child entrypoint and is covered operationally by daemon startup tests @preserve */
     if (!readMachineRuntimeCredentialConfig(agentName).ok) {
         void Promise.resolve().then(() => __importStar(require("./machine-identity"))).then(({ loadOrCreateMachineIdentity }) => {

package/dist/heart/daemon/daemon-entry.js

@@ -66,6 +66,8 @@ const bundle_manifest_1 = require("../../mind/bundle-manifest");
 const mcp_canary_1 = require("./mcp-canary");
 const context_loss_sentinel_1 = require("../context-loss-sentinel");
 const provider_credentials_1 = require("../provider-credentials");
+const runtime_credentials_1 = require("../runtime-credentials");
+const machine_identity_1 = require("../machine-identity");
 function parseSocketPath(argv) {
     const socketIndex = argv.indexOf("--socket");
     if (socketIndex >= 0) {
@@ -100,6 +102,28 @@ const managedPrivateRuntimes = managedAgents.map((agent) => ({
     agent,
     config: (0, agent_discovery_1.readPrivateRuntimeConfig)(agent),
 }));
+function currentMachineId() {
+    return (0, machine_identity_1.loadOrCreateMachineIdentity)().machineId;
+}
+function privateRuntimeCredentialBootstrapFor(agent) {
+    const machineId = currentMachineId();
+    const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
+    const machine = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+    const providerPool = (0, provider_credentials_1.readProviderCredentialPool)(agent);
+    const providerCredentialRecords = providerPool.ok
+        ? Object.values(providerPool.pool.providers).filter((record) => !!record)
+        : [];
+    const bootstrap = {
+        agentName: agent,
+        runtimeConfig: runtime.ok ? runtime.config : undefined,
+        machineRuntimeConfig: machine.ok ? machine.config : undefined,
+        machineId,
+        providerCredentialRecords: providerCredentialRecords.length > 0 ? providerCredentialRecords : undefined,
+    };
+    if (!bootstrap.runtimeConfig && !bootstrap.machineRuntimeConfig && !bootstrap.providerCredentialRecords)
+        return null;
+    return bootstrap;
+}
 function sentinelHealthStatus(receipt) {
     if (receipt.verdict === "ready")
         return "ok";
@@ -178,6 +202,7 @@ const processManager = new process_manager_1.DaemonProcessManager({
         entry: "heart/agent-entry.js",
         channel: "private-runtime",
         autoStart: config.autoStart,
+        getRuntimeCredentialBootstrap: () => privateRuntimeCredentialBootstrapFor(agent),
     })),
     existsSync: fs.existsSync,
     /* v8 ignore next 4 -- wiring: delegates to checkAgentConfig which has full unit tests @preserve */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.682",
+  "version": "0.1.0-alpha.684",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",