@ouro.bot/cli 0.1.0-alpha.683 → 0.1.0-alpha.685

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.685",
+      "changes": [
+        "Prevent scaffold-only bundles from being managed as live agents, and keep hatch/adoption bundles disabled until credentials are stored."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.684",
+      "changes": [
+        "Bootstrap private-runtime provider credentials before queued work is flushed."
+      ]
+    },
     {
       "version": "0.1.0-alpha.683",
       "changes": [

package/dist/heart/agent-entry.js

@@ -122,6 +122,7 @@ if (!ipcState.installed) {
 // Dynamic import: agent-entry is process-start wiring that starts a sense process.
 // Using dynamic import avoids a static heart/ -> senses/ dependency.
 Promise.resolve().then(() => __importStar(require("./runtime-credentials"))).then(async ({ readMachineRuntimeCredentialConfig, readRuntimeCredentialConfig, refreshMachineRuntimeCredentialConfig, refreshRuntimeCredentialConfig, applyRuntimeCredentialBootstrapMessage, waitForRuntimeCredentialBootstrap, }) => {
+    const { readProviderCredentialPool, refreshProviderCredentialPool } = await Promise.resolve().then(() => __importStar(require("./provider-credentials")));
     const bootstrappedBeforeWait = drainBufferedRuntimeCredentialBootstrap(applyRuntimeCredentialBootstrapMessage);
     const bootstrappedDuringWait = bootstrappedBeforeWait ? true : await waitForRuntimeCredentialBootstrap(agentName);
     if (bootstrappedDuringWait) {
@@ -133,6 +134,10 @@ Promise.resolve().then(() => __importStar(require("./runtime-credentials"))).the
     if (!readRuntimeCredentialConfig(agentName).ok) {
         void refreshRuntimeCredentialConfig(agentName, { preserveCachedOnFailure: true }).catch(() => undefined);
     }
+    const providerPool = readProviderCredentialPool(agentName);
+    if (!providerPool.ok || Object.keys(providerPool.pool.providers).length === 0) {
+        await refreshProviderCredentialPool(agentName, { preserveCachedOnFailure: true }).catch(() => undefined);
+    }
     /* v8 ignore next 7 -- process-start best-effort machine credential refresh runs in a child entrypoint and is covered operationally by daemon startup tests @preserve */
     if (!readMachineRuntimeCredentialConfig(agentName).ok) {
         void Promise.resolve().then(() => __importStar(require("./machine-identity"))).then(({ loadOrCreateMachineIdentity }) => {

package/dist/heart/daemon/agent-discovery.js

@@ -51,6 +51,46 @@ const runtime_1 = require("../../nerves/runtime");
 function isLibraryKind(kind) {
     return kind === "library";
 }
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function hasConfiguredVault(parsed) {
+    const vault = parsed.vault;
+    if (!isRecord(vault))
+        return false;
+    return typeof vault.email === "string" && vault.email.trim().length > 0
+        && typeof vault.serverUrl === "string" && vault.serverUrl.trim().length > 0;
+}
+function hasEnabledSync(parsed) {
+    const sync = parsed.sync;
+    return isRecord(sync) && sync.enabled === true;
+}
+function hasEnabledExternalSense(parsed) {
+    const senses = parsed.senses;
+    if (!isRecord(senses))
+        return false;
+    for (const [name, value] of Object.entries(senses)) {
+        if (name === "cli")
+            continue;
+        if (isRecord(value) && value.enabled === true)
+            return true;
+    }
+    return false;
+}
+function isManageableAgentConfig(parsed) {
+    return hasConfiguredVault(parsed)
+        || hasEnabledSync(parsed)
+        || hasEnabledExternalSense(parsed);
+}
+function stripDiscoveryMetadata(row) {
+    const publicRow = { name: row.name, enabled: row.enabled };
+    if (row.kind !== undefined)
+        publicRow.kind = row.kind;
+    if (row.managementBlockedReason !== undefined) {
+        publicRow.managementBlockedReason = row.managementBlockedReason;
+    }
+    return publicRow;
+}
 /**
  * Walk the bundles root and return one row per `<name>.ouro` directory whose
  * `agent.json` is readable and parseable. Includes both enabled and disabled
@@ -62,7 +102,7 @@ function isLibraryKind(kind) {
  *
  * Sorted alphabetically by name for stable display.
  */
-function listAllBundleAgents(options = {}) {
+function discoverBundleAgents(options = {}) {
     const bundlesRoot = options.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
     const readdirSync = options.readdirSync ?? fs.readdirSync;
     const readFileSync = options.readFileSync ?? fs.readFileSync;
@@ -88,34 +128,44 @@ function listAllBundleAgents(options = {}) {
         const configPath = path.join(bundlesRoot, entry.name, "agent.json");
         let enabled = true;
         let kind;
+        let manageable = false;
         try {
             const raw = readFileSync(configPath, "utf-8");
             const parsed = JSON.parse(raw);
+            if (!isRecord(parsed))
+                continue;
             if (typeof parsed.enabled === "boolean") {
                 enabled = parsed.enabled;
             }
             if (typeof parsed.kind === "string") {
                 kind = parsed.kind;
             }
+            manageable = isManageableAgentConfig(parsed);
         }
         catch {
             continue;
         }
-        const row = { name: agentName, enabled };
+        const row = { name: agentName, enabled, manageable };
         if (kind !== undefined)
             row.kind = kind;
+        if (enabled && !isLibraryKind(kind) && !manageable) {
+            row.managementBlockedReason = "inactive scaffold: no vault locator, sync, or enabled external sense";
+        }
         discovered.push(row);
     }
     return discovered.sort((left, right) => left.name.localeCompare(right.name));
 }
+function listAllBundleAgents(options = {}) {
+    return discoverBundleAgents(options).map(stripDiscoveryMetadata);
+}
 /**
  * Real agents only — excludes both disabled bundles and library-kind bundles.
  * Library bundles (SerpentGuide, RepairGuide, …) are content-only and must
  * never appear in spawn lists, status rollups, or sync rows.
  */
 function listEnabledBundleAgents(options = {}) {
-    return listAllBundleAgents(options)
-        .filter((row) => row.enabled && !isLibraryKind(row.kind))
+    return discoverBundleAgents(options)
+        .filter((row) => row.enabled && !isLibraryKind(row.kind) && row.manageable)
         .map((row) => row.name);
 }
 function readPrivateRuntimeConfig(agent, options = {}) {

package/dist/heart/daemon/cli-render.js

@@ -276,7 +276,11 @@ function parseStatusPayload(data) {
         const enabled = booleanField(row.enabled);
         if (!name || enabled === null)
             return null;
-        return { name, enabled };
+        const parsed = { name, enabled };
+        const managementBlockedReason = stringField(row.managementBlockedReason);
+        if (managementBlockedReason !== null)
+            parsed.managementBlockedReason = managementBlockedReason;
+        return parsed;
     });
     const parsedProviders = (providers ?? []).map((entry) => {
         if (!entry || typeof entry !== "object" || Array.isArray(entry))
@@ -437,9 +441,11 @@ function formatDaemonStatusOutput(response, fallback) {
         const agentNameWidth = Math.max(12, ...payload.agents.map((r) => r.name.length));
         for (const row of payload.agents) {
             const name = row.name.padEnd(agentNameWidth);
-            const dot = row.enabled ? green("●") : dim("○");
-            const stateText = row.enabled ? "enabled " : "disabled";
-            lines.push(`    ${name} ${dot} ${stateText}`);
+            const inactive = row.enabled && !!row.managementBlockedReason;
+            const dot = inactive ? yellow("●") : row.enabled ? green("●") : dim("○");
+            const stateText = inactive ? "inactive" : row.enabled ? "enabled " : "disabled";
+            const detail = inactive ? `  ${dim(row.managementBlockedReason)}` : "";
+            lines.push(`    ${name} ${dot} ${stateText}${detail}`);
         }
         lines.push("");
     }

package/dist/heart/daemon/daemon-entry.js

@@ -66,6 +66,8 @@ const bundle_manifest_1 = require("../../mind/bundle-manifest");
 const mcp_canary_1 = require("./mcp-canary");
 const context_loss_sentinel_1 = require("../context-loss-sentinel");
 const provider_credentials_1 = require("../provider-credentials");
+const runtime_credentials_1 = require("../runtime-credentials");
+const machine_identity_1 = require("../machine-identity");
 function parseSocketPath(argv) {
     const socketIndex = argv.indexOf("--socket");
     if (socketIndex >= 0) {
@@ -100,6 +102,28 @@ const managedPrivateRuntimes = managedAgents.map((agent) => ({
     agent,
     config: (0, agent_discovery_1.readPrivateRuntimeConfig)(agent),
 }));
+function currentMachineId() {
+    return (0, machine_identity_1.loadOrCreateMachineIdentity)().machineId;
+}
+function privateRuntimeCredentialBootstrapFor(agent) {
+    const machineId = currentMachineId();
+    const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
+    const machine = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+    const providerPool = (0, provider_credentials_1.readProviderCredentialPool)(agent);
+    const providerCredentialRecords = providerPool.ok
+        ? Object.values(providerPool.pool.providers).filter((record) => !!record)
+        : [];
+    const bootstrap = {
+        agentName: agent,
+        runtimeConfig: runtime.ok ? runtime.config : undefined,
+        machineRuntimeConfig: machine.ok ? machine.config : undefined,
+        machineId,
+        providerCredentialRecords: providerCredentialRecords.length > 0 ? providerCredentialRecords : undefined,
+    };
+    if (!bootstrap.runtimeConfig && !bootstrap.machineRuntimeConfig && !bootstrap.providerCredentialRecords)
+        return null;
+    return bootstrap;
+}
 function sentinelHealthStatus(receipt) {
     if (receipt.verdict === "ready")
         return "ok";
@@ -178,6 +202,7 @@ const processManager = new process_manager_1.DaemonProcessManager({
         entry: "heart/agent-entry.js",
         channel: "private-runtime",
         autoStart: config.autoStart,
+        getRuntimeCredentialBootstrap: () => privateRuntimeCredentialBootstrapFor(agent),
     })),
     existsSync: fs.existsSync,
     /* v8 ignore next 4 -- wiring: delegates to checkAgentConfig which has full unit tests @preserve */

package/dist/heart/daemon/daemon.js

@@ -615,9 +615,10 @@ class OuroDaemon {
         const repoRoot = (0, identity_1.getRepoRoot)();
         const sync = (0, agent_discovery_1.listBundleSyncRows)({ bundlesRoot: this.bundlesRoot });
         const agents = (0, agent_discovery_1.listAllBundleAgents)({ bundlesRoot: this.bundlesRoot });
-        const providers = agents.flatMap((agent) => (0, provider_visibility_1.providerVisibilityStatusRows)((0, provider_visibility_1.buildAgentProviderVisibility)({
-            agentName: agent.name,
-            agentRoot: path.join(this.bundlesRoot, `${agent.name}.ouro`),
+        const providerAgents = (0, agent_discovery_1.listEnabledBundleAgents)({ bundlesRoot: this.bundlesRoot });
+        const providers = providerAgents.flatMap((agentName) => (0, provider_visibility_1.providerVisibilityStatusRows)((0, provider_visibility_1.buildAgentProviderVisibility)({
+            agentName,
+            agentRoot: path.join(this.bundlesRoot, `${agentName}.ouro`),
         })));
         const mailboxUrl = this.mailboxServer?.origin ?? "http://127.0.0.1:0";
         return {

package/dist/heart/hatch/hatch-flow.js

@@ -135,9 +135,16 @@ function writeHatchlingAgentConfig(bundleRoot, input) {
     template.provider = input.provider;
     template.humanFacing = { provider: input.provider, model };
     template.agentFacing = { provider: input.provider, model };
-    template.enabled = true;
+    template.vault = (0, identity_1.resolveVaultConfig)(input.agentName);
+    template.enabled = false;
     fs.writeFileSync(path.join(bundleRoot, "agent.json"), `${JSON.stringify(template, null, 2)}\n`, "utf-8");
 }
+function setHatchlingEnabled(bundleRoot, enabled) {
+    const agentJsonPath = path.join(bundleRoot, "agent.json");
+    const parsed = JSON.parse(fs.readFileSync(agentJsonPath, "utf-8"));
+    parsed.enabled = enabled;
+    fs.writeFileSync(agentJsonPath, `${JSON.stringify(parsed, null, 2)}\n`, "utf-8");
+}
 async function runHatchFlow(input, deps = {}) {
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -180,6 +187,7 @@ async function runHatchFlow(input, deps = {}) {
     writeRecordScaffold(bundleRoot);
     writeFriendImprint(bundleRoot, input.humanName, now);
     writeHeartbeatHabit(bundleRoot, now);
+    setHatchlingEnabled(bundleRoot, true);
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.hatch_flow_end",

package/dist/heart/hatch/specialist-tools.js

@@ -147,6 +147,11 @@ function moveDir(src, dest) {
         /* v8 ignore stop */
     }
 }
+function updateAgentConfig(bundleRoot, updates) {
+    const agentJsonPath = path.join(bundleRoot, "agent.json");
+    const parsed = JSON.parse(fs.readFileSync(agentJsonPath, "utf-8"));
+    fs.writeFileSync(agentJsonPath, `${JSON.stringify({ ...parsed, ...updates }, null, 2)}\n`, "utf-8");
+}
 async function execCompleteAdoption(args, deps) {
     const name = args.name;
     const handoffMessage = args.handoff_message;
@@ -188,6 +193,8 @@ async function execCompleteAdoption(args, deps) {
     catch (error) {
         return `error: failed to read hatchling vault unlock secret: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`;
     }
+    // Keep the bundle inert until vault/provider credentials are durably stored.
+    updateAgentConfig(deps.tempDir, { enabled: false, vault });
     // Scaffold structural dirs into tempDir
     scaffoldBundle(deps.tempDir);
     // Move tempDir -> final bundle location
@@ -237,6 +244,7 @@ async function execCompleteAdoption(args, deps) {
         const friendPath = path.join(targetBundle, "friends", `${friendId}.json`);
         fs.writeFileSync(friendPath, JSON.stringify(friendRecord, null, 2), "utf-8");
     }
+    updateAgentConfig(targetBundle, { enabled: true });
     // Play hatch animation
     await (0, hatch_animation_1.playHatchAnimation)(name, deps.animationWriter);
     // Display handoff message

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.683",
+  "version": "0.1.0-alpha.685",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",