@ouro.bot/cli 0.1.0-alpha.70 → 0.1.0-alpha.700

package/dist/heart/config-registry.js

@@ -0,0 +1,331 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFIG_REGISTRY = void 0;
+exports.getRegistryEntries = getRegistryEntries;
+exports.getRegistryEntriesByTier = getRegistryEntriesByTier;
+exports.getRegistryEntriesByTopic = getRegistryEntriesByTopic;
+exports.getRegistryEntry = getRegistryEntry;
+const runtime_1 = require("../nerves/runtime");
+// --- Validation helpers ---
+const KNOWN_PROVIDERS = ["anthropic", "azure", "minimax", "openai-codex", "github-copilot"];
+function validateNumber(value) {
+    if (typeof value !== "number")
+        return `expected number, got ${typeof value}`;
+    return undefined;
+}
+function validateBoolean(value) {
+    if (typeof value !== "boolean")
+        return `expected boolean, got ${typeof value}`;
+    return undefined;
+}
+function validateString(value) {
+    if (typeof value !== "string")
+        return `expected string, got ${typeof value}`;
+    return undefined;
+}
+function validateStringEnum(allowed) {
+    return (value) => {
+        if (typeof value !== "string")
+            return `expected string, got ${typeof value}`;
+        if (!allowed.includes(value))
+            return `expected one of [${allowed.join(", ")}], got "${value}"`;
+        return undefined;
+    };
+}
+function validateInteger(min, max) {
+    return (value) => {
+        if (typeof value !== "number")
+            return `expected number, got ${typeof value}`;
+        if (!Number.isInteger(value))
+            return `expected integer, got ${value}`;
+        if (value < min || value > max)
+            return `expected integer between ${min} and ${max}, got ${value}`;
+        return undefined;
+    };
+}
+function validateStringArray(value) {
+    if (!Array.isArray(value))
+        return `expected array, got ${typeof value}`;
+    for (let i = 0; i < value.length; i++) {
+        if (typeof value[i] !== "string")
+            return `expected string at index ${i}, got ${typeof value[i]}`;
+    }
+    return undefined;
+}
+function validateStringEnumArray(allowed) {
+    return (value) => {
+        if (!Array.isArray(value))
+            return `expected array, got ${typeof value}`;
+        for (let i = 0; i < value.length; i++) {
+            if (typeof value[i] !== "string")
+                return `expected string at index ${i}, got ${typeof value[i]}`;
+            if (!allowed.includes(value[i]))
+                return `expected one of [${allowed.join(", ")}] at index ${i}, got "${value[i]}"`;
+        }
+        return undefined;
+    };
+}
+function validateObject(requiredFields) {
+    return (value) => {
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            return `expected object, got ${Array.isArray(value) ? "array" : typeof value}`;
+        }
+        const obj = value;
+        for (const [field, validator] of Object.entries(requiredFields)) {
+            if (!(field in obj))
+                return `missing required field "${field}"`;
+            const err = validator(obj[field]);
+            if (err)
+                return `field "${field}": ${err}`;
+        }
+        return undefined;
+    };
+}
+const registryData = [
+    // --- Managed: harness-only ---
+    {
+        path: "version",
+        tier: "managed",
+        description: "Agent config schema version. Managed by the harness. Must be an integer >= 1.",
+        default: 2,
+        effects: "Controls which config migrations apply on load. Changing incorrectly can corrupt config.",
+        topics: ["schema", "migration"],
+        validate: validateNumber,
+    },
+    {
+        path: "enabled",
+        tier: "managed",
+        description: "Whether the agent is enabled. Managed by the harness. When false, the agent refuses to start.",
+        default: true,
+        effects: "Disables all agent functionality when set to false.",
+        topics: ["lifecycle", "activation"],
+        validate: validateBoolean,
+    },
+    // --- Self: agent-configurable ---
+    {
+        path: "mcpServers",
+        tier: "self",
+        description: "MCP server configurations. Maps server name to command, args, and env. The agent can add or remove MCP servers.",
+        default: undefined,
+        effects: "Adds or removes MCP tool servers.",
+        topics: ["tools", "mcp", "servers", "extensions"],
+    },
+    {
+        path: "humanFacing.provider",
+        tier: "self",
+        description: "Provider for human-facing interactions (CLI, Teams, BlueBubbles).",
+        default: "anthropic",
+        effects: "Changes the LLM provider used for all human-facing conversations. Affects quality, latency, and cost.",
+        topics: ["model", "provider", "llm", "human"],
+        validate: validateStringEnum(KNOWN_PROVIDERS),
+    },
+    {
+        path: "humanFacing.model",
+        tier: "self",
+        description: "Model name for human-facing interactions.",
+        default: "claude-opus-4-6",
+        effects: "Changes the specific model used for human-facing conversations.",
+        topics: ["model", "provider", "llm", "human"],
+        validate: validateString,
+    },
+    {
+        path: "agentFacing.provider",
+        tier: "self",
+        description: "Provider for agent-facing interactions (inner lane, delegation).",
+        default: "anthropic",
+        effects: "Changes the LLM provider used for private agent-facing turns and agent-to-agent communication.",
+        topics: ["model", "provider", "llm", "agent", "inner-lane"],
+        validate: validateStringEnum(KNOWN_PROVIDERS),
+    },
+    {
+        path: "agentFacing.model",
+        tier: "self",
+        description: "Model name for agent-facing interactions.",
+        default: "claude-opus-4-6",
+        effects: "Changes the specific model used for private agent-facing turns and agent-to-agent communication.",
+        topics: ["model", "provider", "llm", "agent", "inner-lane"],
+        validate: validateString,
+    },
+    {
+        path: "context.maxTokens",
+        tier: "self",
+        description: "Maximum context window size in tokens.",
+        default: 80000,
+        effects: "Larger values allow more context but increase cost and latency. Must match model capability.",
+        topics: ["context", "tokens", "notes", "performance"],
+        validate: validateInteger(1000, 1000000),
+    },
+    {
+        path: "senses.cli",
+        tier: "self",
+        description: "CLI sense configuration. Controls whether the CLI interface is enabled.",
+        default: { enabled: true },
+        effects: "Enables or disables the CLI (terminal) interaction channel.",
+        topics: ["senses", "cli", "channels", "interface"],
+        validate: validateObject({ enabled: validateBoolean }),
+    },
+    {
+        path: "senses.teams",
+        tier: "self",
+        description: "Teams sense configuration. Controls whether the Teams interface is enabled.",
+        default: { enabled: false },
+        effects: "Enables or disables the Microsoft Teams interaction channel.",
+        topics: ["senses", "teams", "channels", "interface"],
+        validate: validateObject({ enabled: validateBoolean }),
+    },
+    {
+        path: "senses.bluebubbles",
+        tier: "self",
+        description: "BlueBubbles sense configuration. Controls whether the iMessage interface is enabled.",
+        default: { enabled: false },
+        effects: "Enables or disables the BlueBubbles (iMessage) interaction channel.",
+        topics: ["senses", "bluebubbles", "imessage", "channels", "interface"],
+        validate: validateObject({ enabled: validateBoolean }),
+    },
+    {
+        path: "senses.mail",
+        tier: "self",
+        description: "Mail sense configuration. Controls whether the agent-owned Mailroom mailbox is enabled.",
+        default: { enabled: false },
+        effects: "Enables or disables the agent mail sense. Runtime credentials still live in the agent vault.",
+        topics: ["senses", "mail", "mailroom", "channels", "interface"],
+        validate: validateObject({ enabled: validateBoolean }),
+    },
+    {
+        path: "senses.voice",
+        tier: "self",
+        description: "Voice sense configuration. Controls whether conversational audio sessions are enabled.",
+        default: { enabled: false },
+        effects: "Enables or disables voice sessions. STT/TTS credentials and local audio attachments are configured separately.",
+        topics: ["senses", "voice", "audio", "speech", "channels", "interface"],
+        validate: validateObject({ enabled: validateBoolean }),
+    },
+    {
+        path: "senses.workbench",
+        tier: "self",
+        description: "Legacy Workbench sense marker. Runtime-injected Workbench tools do not require this bundle entry.",
+        default: { enabled: false },
+        effects: "Kept only for old bundles; modern Workbench launches the boss with --workbench-mcp and injects tools per turn.",
+        topics: ["senses", "workbench", "mcp", "terminal", "channels", "interface"],
+        validate: validateObject({ enabled: validateBoolean }),
+    },
+    {
+        path: "sync.enabled",
+        tier: "self",
+        description: "Whether git-based bundle sync is enabled.",
+        default: false,
+        effects: "Enables automatic synchronization of agent state via git. Requires sync.remote to be configured.",
+        topics: ["sync", "git", "state", "backup"],
+        validate: validateBoolean,
+    },
+    {
+        path: "sync.remote",
+        tier: "self",
+        description: "Git remote name used for bundle sync.",
+        default: "origin",
+        effects: "Controls which git remote is used when sync is enabled.",
+        topics: ["sync", "git", "remote"],
+        validate: validateString,
+    },
+    {
+        path: "context.contextMargin",
+        tier: "self",
+        description: "Percentage of context window reserved as margin before compaction triggers.",
+        default: 20,
+        effects: "Higher values trigger compaction earlier, preserving more headroom. Lower values use more context.",
+        topics: ["context", "compaction", "notes", "performance"],
+        validate: validateInteger(0, 100),
+    },
+    {
+        path: "phrases.thinking",
+        tier: "self",
+        description: "Array of phrases displayed while the agent is thinking.",
+        default: ["working"],
+        effects: "Changes the thinking indicator text shown to users. Purely cosmetic.",
+        topics: ["phrases", "ux", "display", "personality"],
+        validate: validateStringArray,
+    },
+    {
+        path: "phrases.tool",
+        tier: "self",
+        description: "Array of phrases displayed while the agent is running a tool.",
+        default: ["running tool"],
+        effects: "Changes the tool-use indicator text shown to users. Purely cosmetic.",
+        topics: ["phrases", "ux", "display", "personality"],
+        validate: validateStringArray,
+    },
+    {
+        path: "phrases.followup",
+        tier: "self",
+        description: "Array of phrases displayed during follow-up processing.",
+        default: ["processing"],
+        effects: "Changes the follow-up indicator text shown to users. Purely cosmetic.",
+        topics: ["phrases", "ux", "display", "personality"],
+        validate: validateStringArray,
+    },
+    {
+        path: "shell.defaultTimeout",
+        tier: "self",
+        description: "Default timeout in milliseconds for shell command execution.",
+        default: undefined,
+        effects: "Controls how long shell commands run before timing out. Undefined uses system default.",
+        topics: ["shell", "timeout", "execution", "tools"],
+        validate: validateInteger(1000, 600000),
+    },
+    {
+        path: "logging.level",
+        tier: "self",
+        description: "Minimum log level: debug, info, warn, or error.",
+        default: undefined,
+        effects: "Controls verbosity of runtime logging. Lower levels produce more output.",
+        topics: ["logging", "debug", "diagnostics"],
+        validate: validateStringEnum(["debug", "info", "warn", "error"]),
+    },
+    {
+        path: "logging.sinks",
+        tier: "self",
+        description: "Array of log sink types: 'terminal' and/or 'ndjson'.",
+        default: undefined,
+        effects: "Controls where log output is directed. Terminal shows in console, ndjson writes structured logs.",
+        topics: ["logging", "output", "diagnostics"],
+        validate: validateStringEnumArray(["terminal", "ndjson"]),
+    },
+];
+exports.CONFIG_REGISTRY = new Map(registryData.map((entry) => [entry.path, entry]));
+function getRegistryEntries() {
+    (0, runtime_1.emitNervesEvent)({
+        component: "heart",
+        event: "config_registry.access",
+        message: "listing all registry entries",
+        meta: { count: exports.CONFIG_REGISTRY.size },
+    });
+    return [...exports.CONFIG_REGISTRY.values()];
+}
+function getRegistryEntriesByTier(tier) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "heart",
+        event: "config_registry.access",
+        message: `filtering registry entries by tier ${tier}`,
+        meta: { tier },
+    });
+    return [...exports.CONFIG_REGISTRY.values()].filter((entry) => entry.tier === tier);
+}
+function getRegistryEntriesByTopic(topic) {
+    const needle = topic.toLowerCase();
+    (0, runtime_1.emitNervesEvent)({
+        component: "heart",
+        event: "config_registry.access",
+        message: `filtering registry entries by topic "${topic}"`,
+        meta: { topic },
+    });
+    return [...exports.CONFIG_REGISTRY.values()].filter((entry) => entry.topics.some((t) => t.toLowerCase().includes(needle)));
+}
+function getRegistryEntry(path) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "heart",
+        event: "config_registry.access",
+        message: `looking up registry entry for "${path}"`,
+        meta: { path },
+    });
+    return exports.CONFIG_REGISTRY.get(path);
+}

package/dist/heart/config.js

@@ -35,6 +35,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadConfig = loadConfig;
 exports.resetConfigCache = resetConfigCache;
+exports.cacheRuntimeConfigForTests = cacheRuntimeConfigForTests;
+exports.cacheMachineRuntimeConfigForTests = cacheMachineRuntimeConfigForTests;
 exports.patchRuntimeConfig = patchRuntimeConfig;
 exports.getAzureConfig = getAzureConfig;
 exports.getMinimaxConfig = getMinimaxConfig;
@@ -50,6 +52,7 @@ exports.getTeamsChannelConfig = getTeamsChannelConfig;
 exports.getBlueBubblesConfig = getBlueBubblesConfig;
 exports.getBlueBubblesChannelConfig = getBlueBubblesChannelConfig;
 exports.getIntegrationsConfig = getIntegrationsConfig;
+exports.getSyncConfig = getSyncConfig;
 exports.getOpenAIEmbeddingsApiKey = getOpenAIEmbeddingsApiKey;
 exports.getLogsDir = getLogsDir;
 exports.sanitizeKey = sanitizeKey;
@@ -60,37 +63,10 @@ exports.logPath = logPath;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const identity_1 = require("./identity");
+const provider_credentials_1 = require("./provider-credentials");
+const runtime_credentials_1 = require("./runtime-credentials");
 const runtime_1 = require("../nerves/runtime");
-const DEFAULT_SECRETS_TEMPLATE = {
-    providers: {
-        // Keep provider field ordering consistent: model first, then auth credentials,
-        // then provider-specific transport fields.
-        azure: {
-            modelName: "",
-            apiKey: "",
-            endpoint: "",
-            deployment: "",
-            apiVersion: "2025-04-01-preview",
-            managedIdentityClientId: "",
-        },
-        minimax: {
-            model: "",
-            apiKey: "",
-        },
-        anthropic: {
-            model: "claude-opus-4-6",
-            setupToken: "",
-        },
-        "openai-codex": {
-            model: "gpt-5.4",
-            oauthAccessToken: "",
-        },
-        "github-copilot": {
-            model: "claude-sonnet-4.6",
-            githubToken: "",
-            baseUrl: "",
-        },
-    },
+const DEFAULT_LOCAL_RUNTIME_CONFIG = {
     teams: {
         clientId: "",
         clientSecret: "",
@@ -116,41 +92,41 @@ const DEFAULT_SECRETS_TEMPLATE = {
         serverUrl: "",
         password: "",
         accountId: "default",
+        ownHandles: [],
     },
     bluebubblesChannel: {
         port: 18790,
         webhookPath: "/bluebubbles-webhook",
         requestTimeoutMs: 30000,
     },
+    vault: {
+        masterPassword: "",
+    },
     integrations: {
         perplexityApiKey: "",
         openaiEmbeddingsApiKey: "",
     },
+    features: {
+        workbenchCoding: false,
+    },
 };
 function defaultRuntimeConfig() {
     return {
-        providers: {
-            azure: { ...DEFAULT_SECRETS_TEMPLATE.providers.azure },
-            minimax: { ...DEFAULT_SECRETS_TEMPLATE.providers.minimax },
-            anthropic: { ...DEFAULT_SECRETS_TEMPLATE.providers.anthropic },
-            "openai-codex": { ...DEFAULT_SECRETS_TEMPLATE.providers["openai-codex"] },
-            "github-copilot": { ...DEFAULT_SECRETS_TEMPLATE.providers["github-copilot"] },
-        },
-        teams: { ...DEFAULT_SECRETS_TEMPLATE.teams },
-        teamsSecondary: { ...DEFAULT_SECRETS_TEMPLATE.teamsSecondary },
-        oauth: { ...DEFAULT_SECRETS_TEMPLATE.oauth },
+        teams: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.teams },
+        teamsSecondary: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.teamsSecondary },
+        oauth: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.oauth },
         context: { ...identity_1.DEFAULT_AGENT_CONTEXT },
-        teamsChannel: { ...DEFAULT_SECRETS_TEMPLATE.teamsChannel },
-        bluebubbles: { ...DEFAULT_SECRETS_TEMPLATE.bluebubbles },
-        bluebubblesChannel: { ...DEFAULT_SECRETS_TEMPLATE.bluebubblesChannel },
-        integrations: { ...DEFAULT_SECRETS_TEMPLATE.integrations },
+        teamsChannel: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.teamsChannel },
+        bluebubbles: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.bluebubbles },
+        bluebubblesChannel: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.bluebubblesChannel },
+        vault: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.vault },
+        integrations: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.integrations },
+        features: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.features },
     };
 }
 let _runtimeConfigOverride = null;
 let _testContextOverride = null;
-function resolveConfigPath() {
-    return (0, identity_1.getAgentSecretsPath)();
-}
+let _providerConfigOverride = null;
 function deepMerge(defaults, partial) {
     const result = { ...defaults };
     for (const key of Object.keys(partial)) {
@@ -167,79 +143,31 @@ function deepMerge(defaults, partial) {
     }
     return result;
 }
+function localRuntimeFields(config) {
+    const { providers: _providers, context: _context, ...localFields } = config;
+    return localFields;
+}
 function loadConfig() {
-    const configPath = resolveConfigPath();
-    // Auto-create config directory if it doesn't exist
-    const configDir = path.dirname(configPath);
-    fs.mkdirSync(configDir, { recursive: true });
-    let fileData = {};
-    try {
-        const raw = fs.readFileSync(configPath, "utf-8");
-        fileData = JSON.parse(raw);
-    }
-    catch (error) {
-        const errorCode = error &&
-            typeof error === "object" &&
-            "code" in error &&
-            typeof error.code === "string"
-            ? error.code
-            : undefined;
-        if (errorCode === "ENOENT") {
-            try {
-                fs.writeFileSync(configPath, JSON.stringify(DEFAULT_SECRETS_TEMPLATE, null, 2) + "\n", "utf-8");
-            }
-            catch (writeError) {
-                (0, runtime_1.emitNervesEvent)({
-                    level: "warn",
-                    event: "config_identity.error",
-                    component: "config/identity",
-                    message: "failed writing default secrets config",
-                    meta: {
-                        phase: "loadConfig",
-                        path: configPath,
-                        reason: writeError instanceof Error ? writeError.message : String(writeError),
-                    },
-                });
-            }
-        }
-        (0, runtime_1.emitNervesEvent)({
-            level: "warn",
-            event: "config_identity.error",
-            component: "config/identity",
-            message: "config read failed; defaults applied",
-            meta: {
-                phase: "loadConfig",
-                reason: error instanceof Error ? error.message : String(error),
-            },
-        });
-        // ENOENT or parse error -- use defaults
-    }
-    const sanitizedFileData = { ...fileData };
-    if ("context" in sanitizedFileData) {
-        delete sanitizedFileData.context;
-        (0, runtime_1.emitNervesEvent)({
-            level: "warn",
-            event: "config_identity.error",
-            component: "config/identity",
-            message: "ignored legacy context block in secrets config",
-            meta: {
-                phase: "loadConfig",
-                path: configPath,
-            },
-        });
-    }
-    const mergedConfig = deepMerge(defaultRuntimeConfig(), sanitizedFileData);
+    const agentName = (0, identity_1.getAgentName)();
+    const runtimeResult = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agentName);
+    const machineRuntimeResult = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agentName);
+    const vaultData = runtimeResult.ok ? localRuntimeFields(runtimeResult.config) : {};
+    const machineVaultData = machineRuntimeResult.ok ? localRuntimeFields(machineRuntimeResult.config) : {};
+    const mergedConfig = deepMerge(defaultRuntimeConfig(), vaultData);
+    const mergedWithMachineConfig = deepMerge(mergedConfig, machineVaultData);
     const config = _runtimeConfigOverride
-        ? deepMerge(mergedConfig, _runtimeConfigOverride)
-        : mergedConfig;
+        ? deepMerge(mergedWithMachineConfig, _runtimeConfigOverride)
+        : mergedWithMachineConfig;
     (0, runtime_1.emitNervesEvent)({
         event: "config.load",
         component: "config/identity",
-        message: "config loaded from disk",
+        message: "config loaded from runtime credential cache",
         meta: {
-            source: "disk",
-            used_defaults_only: Object.keys(fileData).length === 0,
+            source: runtimeResult.ok ? "vault-cache" : "defaults",
+            used_defaults_only: !runtimeResult.ok,
+            machine_runtime_credentials: machineRuntimeResult.ok ? "available" : machineRuntimeResult.reason,
             override_applied: _runtimeConfigOverride !== null,
+            runtime_credentials: runtimeResult.ok ? "available" : runtimeResult.reason,
         },
     });
     return config;
@@ -247,34 +175,78 @@ function loadConfig() {
 function resetConfigCache() {
     _runtimeConfigOverride = null;
     _testContextOverride = null;
+    _providerConfigOverride = null;
+    (0, provider_credentials_1.resetProviderCredentialCache)();
+    (0, runtime_credentials_1.resetRuntimeCredentialConfigCache)();
+}
+function cacheRuntimeConfigForTests(agentName, config) {
+    (0, runtime_credentials_1.cacheRuntimeCredentialConfig)(agentName, config, new Date(0));
+}
+function cacheMachineRuntimeConfigForTests(agentName, config) {
+    (0, runtime_credentials_1.cacheMachineRuntimeCredentialConfig)(agentName, config, new Date(0), "machine_test");
+}
+function seedProviderCredentialCache(providers) {
+    if (!providers)
+        return;
+    _providerConfigOverride = deepMerge((_providerConfigOverride ?? {}), providers);
+    const records = Object.entries(_providerConfigOverride).map(([provider, rawConfig]) => {
+        const split = (0, provider_credentials_1.splitProviderCredentialFields)(provider, rawConfig);
+        return (0, provider_credentials_1.createProviderCredentialRecord)({
+            provider: provider,
+            credentials: split.credentials,
+            config: split.config,
+            provenance: { source: "manual" },
+            now: new Date(0),
+        });
+    });
+    (0, provider_credentials_1.cacheProviderCredentialRecords)((0, identity_1.getAgentName)(), records, new Date(0));
 }
 function patchRuntimeConfig(partial) {
+    const { providers, ...runtimePartial } = partial;
+    seedProviderCredentialCache(providers);
     const contextPatch = partial.context;
     if (contextPatch) {
         const base = _testContextOverride ?? identity_1.DEFAULT_AGENT_CONTEXT;
         _testContextOverride = deepMerge(base, contextPatch);
     }
-    _runtimeConfigOverride = deepMerge((_runtimeConfigOverride ?? {}), partial);
+    _runtimeConfigOverride = deepMerge((_runtimeConfigOverride ?? {}), runtimePartial);
+}
+function readProviderConfig(provider) {
+    const cached = (0, provider_credentials_1.readCachedProviderCredentialRecord)((0, identity_1.getAgentName)(), provider);
+    return cached.ok ? { ...cached.record.config, ...cached.record.credentials } : {};
 }
 function getAzureConfig() {
-    const config = loadConfig();
-    return { ...config.providers.azure };
+    const raw = readProviderConfig("azure");
+    return {
+        apiKey: typeof raw.apiKey === "string" ? raw.apiKey : "",
+        endpoint: typeof raw.endpoint === "string" ? raw.endpoint : "",
+        deployment: typeof raw.deployment === "string" ? raw.deployment : "",
+        apiVersion: typeof raw.apiVersion === "string" ? raw.apiVersion : "2025-04-01-preview",
+        managedIdentityClientId: typeof raw.managedIdentityClientId === "string" ? raw.managedIdentityClientId : "",
+    };
 }
 function getMinimaxConfig() {
-    const config = loadConfig();
-    return { ...config.providers.minimax };
+    const raw = readProviderConfig("minimax");
+    return { apiKey: typeof raw.apiKey === "string" ? raw.apiKey : "" };
 }
 function getAnthropicConfig() {
-    const config = loadConfig();
-    return { ...config.providers.anthropic };
+    const raw = readProviderConfig("anthropic");
+    return { setupToken: typeof raw.setupToken === "string" ? raw.setupToken : "" };
 }
 function getOpenAICodexConfig() {
-    const config = loadConfig();
-    return { ...config.providers["openai-codex"] };
+    const raw = readProviderConfig("openai-codex");
+    return {
+        oauthAccessToken: typeof raw.oauthAccessToken === "string" ? raw.oauthAccessToken : "",
+        ...(typeof raw.refreshToken === "string" ? { refreshToken: raw.refreshToken } : {}),
+        ...(typeof raw.expiresAt === "number" ? { expiresAt: raw.expiresAt } : {}),
+    };
 }
 function getGithubCopilotConfig() {
-    const config = loadConfig();
-    return { ...config.providers["github-copilot"] };
+    const raw = readProviderConfig("github-copilot");
+    return {
+        githubToken: typeof raw.githubToken === "string" ? raw.githubToken : "",
+        baseUrl: typeof raw.baseUrl === "string" ? raw.baseUrl : "",
+    };
 }
 function getTeamsConfig() {
     const config = loadConfig();
@@ -321,17 +293,24 @@ function getTeamsChannelConfig() {
 }
 function getBlueBubblesConfig() {
     const config = loadConfig();
-    const { serverUrl, password, accountId } = config.bluebubbles;
+    const { serverUrl, password, accountId, ownHandles } = config.bluebubbles;
     if (!serverUrl.trim()) {
-        throw new Error("bluebubbles.serverUrl is required in secrets.json to run the BlueBubbles sense.");
+        throw new Error("bluebubbles.serverUrl is required in this machine's agent-vault runtime config. Run `ouro connect bluebubbles --agent <agent>`.");
     }
     if (!password.trim()) {
-        throw new Error("bluebubbles.password is required in secrets.json to run the BlueBubbles sense.");
+        throw new Error("bluebubbles.password is required in this machine's agent-vault runtime config. Run `ouro connect bluebubbles --agent <agent>`.");
+    }
+    const normalizedHandles = [];
+    for (const handle of ownHandles) {
+        const trimmed = handle.trim();
+        if (trimmed.length > 0)
+            normalizedHandles.push(trimmed);
     }
     return {
         serverUrl: serverUrl.trim(),
         password: password.trim(),
         accountId: accountId.trim() || "default",
+        ownHandles: normalizedHandles,
     };
 }
 function getBlueBubblesChannelConfig() {
@@ -343,6 +322,19 @@ function getIntegrationsConfig() {
     const config = loadConfig();
     return { ...config.integrations };
 }
+function getSyncConfig() {
+    try {
+        const agentConfig = (0, identity_1.loadAgentConfig)();
+        return {
+            enabled: agentConfig.sync?.enabled ?? false,
+            remote: agentConfig.sync?.remote ?? "origin",
+        };
+    }
+    catch {
+        /* v8 ignore next -- defensive: loadAgentConfig failure in test/bootstrap @preserve */
+        return { enabled: false, remote: "origin" };
+    }
+}
 function getOpenAIEmbeddingsApiKey() {
     return getIntegrationsConfig().openaiEmbeddingsApiKey;
 }