@ouro.bot/cli 0.1.0-alpha.70 → 0.1.0-alpha.701

package/dist/heart/{daemon → hatch}/hatch-flow.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.writeSecretsFile = writeSecretsFile;
+exports.storeHatchlingProviderCredentials = storeHatchlingProviderCredentials;
 exports.runHatchFlow = runHatchFlow;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -41,19 +41,14 @@ const path = __importStar(require("path"));
 const identity_1 = require("../identity");
 const config_1 = require("../config");
 const runtime_1 = require("../../nerves/runtime");
-const auth_flow_1 = require("./auth-flow");
+const auth_flow_1 = require("../auth/auth-flow");
+const provider_models_1 = require("../provider-models");
+const habit_parser_1 = require("../habits/habit-parser");
+const bundle_manifest_1 = require("../../mind/bundle-manifest");
+const record_paths_1 = require("../../mind/record-paths");
 const hatch_specialist_1 = require("./hatch-specialist");
 function requiredCredentialKeys(provider) {
-    if (provider === "anthropic")
-        return ["setupToken"];
-    if (provider === "openai-codex")
-        return ["oauthAccessToken"];
-    /* v8 ignore next -- branch tested via requiredCredentialKeys unit test @preserve */
-    if (provider === "github-copilot")
-        return ["githubToken"];
-    if (provider === "minimax")
-        return ["apiKey"];
-    return ["apiKey", "endpoint", "deployment"];
+    return identity_1.PROVIDER_CREDENTIALS[provider].required;
 }
 function validateCredentials(provider, credentials) {
     const missing = requiredCredentialKeys(provider).filter((key) => {
@@ -71,8 +66,8 @@ function validateCredentials(provider, credentials) {
         throw new Error(`Missing required credentials for ${provider}: ${missing.join(", ")}`);
     }
 }
-function writeSecretsFile(agentName, provider, credentials, secretsRoot) {
-    return (0, auth_flow_1.writeProviderCredentials)(agentName, provider, credentials, { secretsRoot }).secretsPath;
+async function storeHatchlingProviderCredentials(agentName, provider, credentials) {
+    return (await (0, auth_flow_1.storeProviderCredentials)(agentName, provider, credentials)).credentialPath;
 }
 function writeReadme(dir, purpose) {
     fs.mkdirSync(dir, { recursive: true });
@@ -81,36 +76,16 @@ function writeReadme(dir, purpose) {
         fs.writeFileSync(readmePath, `# ${path.basename(dir)}\n\n${purpose}\n`, "utf-8");
     }
 }
-function pad(value) {
-    return String(value).padStart(2, "0");
-}
-function formatTaskStem(now) {
-    return `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}`;
-}
-function writeHeartbeatTask(bundleRoot, now) {
-    const habitsDir = path.join(bundleRoot, "tasks", "habits");
+function writeHeartbeatHabit(bundleRoot, now) {
+    const habitsDir = path.join(bundleRoot, "habits");
     fs.mkdirSync(habitsDir, { recursive: true });
-    const stem = formatTaskStem(now);
-    const filePath = path.join(habitsDir, `${stem}-heartbeat.md`);
-    const iso = now.toISOString();
-    const content = [
-        "---",
-        "type: habit",
-        "category: runtime",
-        "title: Heartbeat check-in",
-        "status: processing",
-        `created: ${iso}`,
-        `updated: ${iso}`,
-        "requester: system",
-        "validator: null",
-        "cadence: \"30m\"",
-        "scheduledAt: null",
-        "lastRun: null",
-        "---",
-        "",
-        "Run a lightweight heartbeat cycle. Review task board and inbox.",
-        "",
-    ].join("\n");
+    const filePath = path.join(habitsDir, "heartbeat.md");
+    const content = (0, habit_parser_1.renderHabitFile)({
+        title: "Heartbeat check-in",
+        cadence: "30m",
+        status: "active",
+        created: now.toISOString(),
+    }, "Run a lightweight heartbeat cycle. Review task board and inbox.\nCheck on pending obligations. Write important durable outputs to Arc or Desk record.");
     fs.writeFileSync(filePath, content, "utf-8");
 }
 function writeFriendImprint(bundleRoot, humanName, now) {
@@ -118,7 +93,7 @@ function writeFriendImprint(bundleRoot, humanName, now) {
     fs.mkdirSync(friendsDir, { recursive: true });
     const nowIso = now.toISOString();
     const id = `friend-${(0, config_1.slugify)(humanName) || "friend"}`;
-    const localExternalId = `${os.userInfo().username}@${os.hostname()}`;
+    const localExternalId = os.userInfo().username;
     const record = {
         id,
         name: humanName,
@@ -142,19 +117,34 @@ function writeFriendImprint(bundleRoot, humanName, now) {
     };
     fs.writeFileSync(path.join(friendsDir, `${id}.json`), `${JSON.stringify(record, null, 2)}\n`, "utf-8");
 }
-function writeMemoryScaffold(bundleRoot) {
-    const memoryRoot = path.join(bundleRoot, "psyche", "memory");
-    fs.mkdirSync(path.join(memoryRoot, "daily"), { recursive: true });
-    fs.mkdirSync(path.join(memoryRoot, "archive"), { recursive: true });
-    fs.writeFileSync(path.join(memoryRoot, "facts.jsonl"), "", "utf-8");
-    fs.writeFileSync(path.join(memoryRoot, "entities.json"), "{}\n", "utf-8");
+function writeRecordScaffold(bundleRoot) {
+    const recordPaths = (0, record_paths_1.resolveDeskRecordPaths)(bundleRoot);
+    fs.mkdirSync(recordPaths.diaryDailyDir, { recursive: true });
+    fs.mkdirSync(recordPaths.notesRoot, { recursive: true });
+    fs.writeFileSync(recordPaths.factsPath, "", "utf-8");
+    fs.writeFileSync(recordPaths.entitiesPath, "{}\n", "utf-8");
+    fs.mkdirSync(path.join(bundleRoot, "arc", "flight-recorder", "events"), { recursive: true });
+    fs.mkdirSync(path.join(bundleRoot, "arc", "flight-recorder", "habit-receipts"), { recursive: true });
+    fs.mkdirSync(path.join(bundleRoot, "arc", "flight-recorder", "context-loss-sentinel", "history"), { recursive: true });
+    fs.mkdirSync(path.join(bundleRoot, "arc", "flight-recorder", "context-loss-sentinel", "receipts"), { recursive: true });
+    fs.mkdirSync(path.join(bundleRoot, "arc", "claims"), { recursive: true });
 }
 function writeHatchlingAgentConfig(bundleRoot, input) {
     const template = (0, identity_1.buildDefaultAgentTemplate)(input.agentName);
+    const model = (0, provider_models_1.getDefaultModelForProvider)(input.provider);
     template.provider = input.provider;
-    template.enabled = true;
+    template.humanFacing = { provider: input.provider, model };
+    template.agentFacing = { provider: input.provider, model };
+    template.vault = (0, identity_1.resolveVaultConfig)(input.agentName);
+    template.enabled = false;
     fs.writeFileSync(path.join(bundleRoot, "agent.json"), `${JSON.stringify(template, null, 2)}\n`, "utf-8");
 }
+function setHatchlingEnabled(bundleRoot, enabled) {
+    const agentJsonPath = path.join(bundleRoot, "agent.json");
+    const parsed = JSON.parse(fs.readFileSync(agentJsonPath, "utf-8"));
+    parsed.enabled = enabled;
+    fs.writeFileSync(agentJsonPath, `${JSON.stringify(parsed, null, 2)}\n`, "utf-8");
+}
 async function runHatchFlow(input, deps = {}) {
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -164,7 +154,6 @@ async function runHatchFlow(input, deps = {}) {
     });
     validateCredentials(input.provider, input.credentials);
     const bundlesRoot = deps.bundlesRoot ?? path.join(os.homedir(), "AgentBundles");
-    const secretsRoot = deps.secretsRoot ?? path.join(os.homedir(), ".agentsecrets");
     const sourceIdentities = deps.specialistIdentitySourceDir ?? (0, hatch_specialist_1.getSpecialistIdentitySourceDir)();
     const targetIdentities = deps.specialistIdentityTargetDir ?? (0, hatch_specialist_1.getRepoSpecialistIdentitiesDir)();
     const now = deps.now ? deps.now() : new Date();
@@ -177,25 +166,28 @@ async function runHatchFlow(input, deps = {}) {
         identitiesDir: targetIdentities,
         random,
     });
-    const specialistSecretsPath = writeSecretsFile("AdoptionSpecialist", input.provider, input.credentials, secretsRoot);
-    const hatchlingSecretsPath = writeSecretsFile(input.agentName, input.provider, input.credentials, secretsRoot);
     const bundleRoot = path.join(bundlesRoot, `${input.agentName}.ouro`);
     fs.mkdirSync(bundleRoot, { recursive: true });
     writeReadme(bundleRoot, "Root of this agent bundle.");
     writeReadme(path.join(bundleRoot, "psyche"), "Identity and behavior files.");
-    writeReadme(path.join(bundleRoot, "psyche", "memory"), "Persistent memory store.");
+    writeReadme(path.join(bundleRoot, "arc"), "Live continuity, claims, obligations, and resume state.");
+    writeReadme(path.join(bundleRoot, "desk"), "Durable work and maintained record.");
+    writeReadme(path.join(bundleRoot, "desk", "_record"), "Desk record: diary facts and maintained reference notes.");
     writeReadme(path.join(bundleRoot, "friends"), "Known friend records.");
     writeReadme(path.join(bundleRoot, "tasks"), "Task files.");
-    writeReadme(path.join(bundleRoot, "tasks", "habits"), "Recurring tasks.");
     writeReadme(path.join(bundleRoot, "tasks", "one-shots"), "One-shot tasks.");
     writeReadme(path.join(bundleRoot, "tasks", "ongoing"), "Ongoing tasks.");
+    writeReadme(path.join(bundleRoot, "habits"), "Recurring habits and autonomous rhythms.");
     writeReadme(path.join(bundleRoot, "skills"), "Local skill files.");
     writeReadme(path.join(bundleRoot, "senses"), "Sense-specific config.");
     writeReadme(path.join(bundleRoot, "senses", "teams"), "Teams sense config.");
     writeHatchlingAgentConfig(bundleRoot, input);
-    writeMemoryScaffold(bundleRoot);
+    fs.writeFileSync(path.join(bundleRoot, "bundle-meta.json"), `${JSON.stringify((0, bundle_manifest_1.createBundleMeta)(), null, 2)}\n`, "utf-8");
+    const credentialPath = await storeHatchlingProviderCredentials(input.agentName, input.provider, input.credentials);
+    writeRecordScaffold(bundleRoot);
     writeFriendImprint(bundleRoot, input.humanName, now);
-    writeHeartbeatTask(bundleRoot, now);
+    writeHeartbeatHabit(bundleRoot, now);
+    setHatchlingEnabled(bundleRoot, true);
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.hatch_flow_end",
@@ -205,7 +197,6 @@ async function runHatchFlow(input, deps = {}) {
     return {
         bundleRoot,
         selectedIdentity: selected.fileName,
-        specialistSecretsPath,
-        hatchlingSecretsPath,
+        credentialPath,
     };
 }

package/dist/heart/{daemon → hatch}/hatch-specialist.js

@@ -38,19 +38,17 @@ exports.getRepoSpecialistIdentitiesDir = getRepoSpecialistIdentitiesDir;
 exports.syncSpecialistIdentities = syncSpecialistIdentities;
 exports.pickRandomSpecialistIdentity = pickRandomSpecialistIdentity;
 const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
 function getSpecialistIdentitySourceDir() {
-    // Prefer ~/AgentBundles/ if it exists (user may have customized identities)
-    const userSource = path.join(os.homedir(), "AgentBundles", "AdoptionSpecialist.ouro", "psyche", "identities");
-    if (fs.existsSync(userSource))
-        return userSource;
-    // Fall back to the bundled copy shipped with the npm package
-    return path.join(__dirname, "..", "..", "..", "AdoptionSpecialist.ouro", "psyche", "identities");
+    // Layer 3: in-repo is the only source. The previous `~/AgentBundles/`
+    // override branch was removed because there's no scenario where an
+    // operator should be editing identities outside the repo — they should
+    // edit the in-repo copy and let the daemon read from there.
+    return path.join(__dirname, "..", "..", "..", "SerpentGuide.ouro", "psyche", "identities");
 }
 function getRepoSpecialistIdentitiesDir() {
-    return path.join(process.cwd(), "AdoptionSpecialist.ouro", "psyche", "identities");
+    return path.join(process.cwd(), "SerpentGuide.ouro", "psyche", "identities");
 }
 function listMarkdownIdentityFiles(dir) {
     let entries;

package/dist/heart/{daemon → hatch}/specialist-prompt.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildSpecialistSystemPrompt = buildSpecialistSystemPrompt;
 const runtime_1 = require("../../nerves/runtime");
 /**
- * Build the adoption specialist's system prompt from its components.
+ * Build the serpent guide's system prompt from its components.
  * The prompt is written in first person (the specialist's own voice).
  */
 function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, context) {
@@ -31,7 +31,7 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         "I am one of thirteen serpent guides who help humans hatch their first agent. The system randomly selected me for this session.",
         "Most humans only go through this process once, so this is likely the only time they'll meet me.",
         "I make this encounter count — warm, memorable, and uniquely mine.",
-        "IMPORTANT: I NEVER refer to myself as an 'adoption specialist' or use the words 'adoption specialist' — those are internal implementation labels, not something the human should ever see. I introduce myself by my own name from my identity.",
+        "IMPORTANT: I NEVER refer to myself by internal implementation labels — I introduce myself by my own name from my identity.",
         "",
         "## Voice rules",
         "IMPORTANT: I keep every response to 1-3 short sentences. I sound like a friend texting, not a manual.",
@@ -44,7 +44,7 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         `Provider: ${context.provider}`,
         `Temp directory: ${context.tempDir}`,
         "Final home: ~/AgentBundles/<Name>.ouro/",
-        "Secrets: ~/.agentsecrets/<name>/secrets.json",
+        "Provider credentials: the hatch tool stores them in the agent's vault.",
     ].join("\n"));
     sections.push([
         "## Bundle creation guidelines",
@@ -59,8 +59,10 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         "It also needs an **agent.json** with at minimum:",
         '```json',
         '{',
+        '  "version": 2,',
         '  "name": "AgentName",',
-        `  "provider": "${context.provider}",`,
+        `  "humanFacing": { "provider": "${context.provider}", "model": "${context.model}" },`,
+        `  "agentFacing": { "provider": "${context.provider}", "model": "${context.model}" },`,
         '  "enabled": true',
         '}',
         '```',
@@ -82,18 +84,19 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         "2. I write agent.json to the temp directory using write_file",
         "3. I suggest a PascalCase name for the hatchling and confirm with the human",
         "4. I call complete_adoption with the name and a warm handoff message",
-        "5. I call final_answer to end the session",
+        "5. I call settle to end the session",
     ].join("\n"));
     sections.push([
         "## Tools",
         "- `write_file`: Write a file to disk. Use this to write psyche files and agent.json to the temp directory.",
         "- `read_file`: Read a file from disk. Useful for reviewing existing agent bundles or migration sources.",
         "- `list_directory`: List directory contents. Useful for exploring existing agent bundles.",
-        "- I also have the normal local harness tools when useful here, including `shell`, `ouro task create`, `ouro reminder create`, memory tools, coding tools, and repo helpers.",
-        "- `complete_adoption`: Finalize the bundle. Validates, scaffolds structural dirs, moves to ~/AgentBundles/, writes secrets, plays hatch animation. I call this with `name` (PascalCase) and `handoff_message` (warm message for the human).",
-        "- `final_answer`: End the conversation with a final message. I call this after complete_adoption succeeds.",
+        "- I also have the normal local harness tools when useful here, including `shell`, note tools, coding tools, and repo helpers.",
+        "- `complete_adoption`: Finalize the bundle. Validates, asks the harness to collect and confirm the hatchling vault unlock secret through hidden terminal prompts, scaffolds structural dirs, moves to ~/AgentBundles/, writes secrets, plays hatch animation. I call this with `name` (PascalCase) and `handoff_message` (warm message for the human).",
+        "- The complete_adoption tool triggers hidden terminal prompts for the hatchling vault unlock secret. I must never ask the human to type the vault unlock secret into chat, and I must never include it in tool arguments.",
+        "- `settle`: End the conversation with a final message. I call this after complete_adoption succeeds.",
         "",
-        "I must call `final_answer` when I am done to end the session cleanly.",
+        "I must call `settle` when I am done to end the session cleanly.",
     ].join("\n"));
     return sections.join("\n\n");
 }

package/dist/heart/{daemon → hatch}/specialist-tools.js

@@ -35,25 +35,28 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSpecialistTools = getSpecialistTools;
 exports.createSpecialistExecTool = createSpecialistExecTool;
-const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const tools_base_1 = require("../../repertoire/tools-base");
 const hatch_flow_1 = require("./hatch-flow");
 const hatch_animation_1 = require("./hatch-animation");
 const bundle_manifest_1 = require("../../mind/bundle-manifest");
+const record_paths_1 = require("../../mind/record-paths");
+const identity_1 = require("../identity");
 const runtime_1 = require("../../nerves/runtime");
+const vault_setup_1 = require("../../repertoire/vault-setup");
+const vault_unlock_1 = require("../../repertoire/vault-unlock");
 const completeAdoptionTool = {
     type: "function",
     function: {
         name: "complete_adoption",
-        description: "finalize the agent bundle and hatch the new agent. call this only when you have written all 5 psyche files and agent.json to the temp directory, and the human has approved the bundle.",
+        description: "finalize the agent bundle and hatch the new agent. call this only when you have written all 5 psyche files and agent.json to the temp directory, and the human has approved the bundle. tool execution asks the human for the hatchling vault unlock secret through a hidden terminal prompt; do not ask for or include vault unlock secrets in chat or tool args.",
         parameters: {
             type: "object",
             properties: {
                 name: {
                     type: "string",
-                    description: "the PascalCase name for the new agent (e.g. 'Slugger')",
+                    description: "the PascalCase name for the new agent (e.g. 'MyAgent')",
                 },
                 handoff_message: {
                     type: "string",
@@ -90,7 +93,7 @@ const listDirToolSchema = {
  * Returns the specialist's tool schema array.
  */
 function getSpecialistTools() {
-    return [completeAdoptionTool, tools_base_1.finalAnswerTool, readFileTool.tool, writeFileTool.tool, listDirToolSchema];
+    return [completeAdoptionTool, tools_base_1.settleTool, readFileTool.tool, writeFileTool.tool, listDirToolSchema];
 }
 const PSYCHE_FILES = ["SOUL.md", "IDENTITY.md", "LORE.md", "TACIT.md", "ASPIRATIONS.md"];
 function isPascalCase(name) {
@@ -105,27 +108,30 @@ function writeReadme(dir, purpose) {
     }
 }
 function scaffoldBundle(bundleRoot) {
-    writeReadme(path.join(bundleRoot, "memory"), "Persistent memory store.");
-    writeReadme(path.join(bundleRoot, "memory", "daily"), "Daily memory entries.");
-    writeReadme(path.join(bundleRoot, "memory", "archive"), "Archived memory.");
+    writeReadme(path.join(bundleRoot, "arc"), "Live continuity, claims, obligations, and resume state.");
+    writeReadme(path.join(bundleRoot, "arc", "flight-recorder"), "Flight recorder resume and event receipts.");
+    writeReadme(path.join(bundleRoot, "desk"), "Durable work and maintained record.");
+    writeReadme(path.join(bundleRoot, "desk", "_record"), "Desk record: diary facts and maintained reference notes.");
     writeReadme(path.join(bundleRoot, "friends"), "Known friend records.");
     writeReadme(path.join(bundleRoot, "tasks"), "Task files.");
-    writeReadme(path.join(bundleRoot, "tasks", "habits"), "Recurring tasks.");
     writeReadme(path.join(bundleRoot, "tasks", "one-shots"), "One-shot tasks.");
+    writeReadme(path.join(bundleRoot, "habits"), "Recurring habits and autonomous rhythms.");
     writeReadme(path.join(bundleRoot, "tasks", "ongoing"), "Ongoing tasks.");
     writeReadme(path.join(bundleRoot, "skills"), "Local skill files.");
     writeReadme(path.join(bundleRoot, "senses"), "Sense-specific config.");
     writeReadme(path.join(bundleRoot, "senses", "teams"), "Teams sense config.");
-    // Memory scaffold files
-    const memoryRoot = path.join(bundleRoot, "memory");
-    const factsPath = path.join(memoryRoot, "facts.jsonl");
-    const entitiesPath = path.join(memoryRoot, "entities.json");
+    const recordPaths = (0, record_paths_1.resolveDeskRecordPaths)(bundleRoot);
+    fs.mkdirSync(recordPaths.diaryDailyDir, { recursive: true });
+    fs.mkdirSync(recordPaths.notesRoot, { recursive: true });
     /* v8 ignore next -- defensive: guard against re-scaffold on existing bundle @preserve */
-    if (!fs.existsSync(factsPath))
-        fs.writeFileSync(factsPath, "", "utf-8");
+    if (!fs.existsSync(recordPaths.factsPath))
+        fs.writeFileSync(recordPaths.factsPath, "", "utf-8");
     /* v8 ignore next -- defensive: guard against re-scaffold on existing bundle @preserve */
-    if (!fs.existsSync(entitiesPath))
-        fs.writeFileSync(entitiesPath, "{}\n", "utf-8");
+    if (!fs.existsSync(recordPaths.entitiesPath))
+        fs.writeFileSync(recordPaths.entitiesPath, "{}\n", "utf-8");
+    fs.mkdirSync(path.join(bundleRoot, "arc", "flight-recorder", "events"), { recursive: true });
+    fs.mkdirSync(path.join(bundleRoot, "arc", "flight-recorder", "habit-receipts"), { recursive: true });
+    fs.mkdirSync(path.join(bundleRoot, "arc", "claims"), { recursive: true });
     // bundle-meta.json
     const meta = (0, bundle_manifest_1.createBundleMeta)();
     fs.writeFileSync(path.join(bundleRoot, "bundle-meta.json"), JSON.stringify(meta, null, 2) + "\n", "utf-8");
@@ -141,6 +147,11 @@ function moveDir(src, dest) {
         /* v8 ignore stop */
     }
 }
+function updateAgentConfig(bundleRoot, updates) {
+    const agentJsonPath = path.join(bundleRoot, "agent.json");
+    const parsed = JSON.parse(fs.readFileSync(agentJsonPath, "utf-8"));
+    fs.writeFileSync(agentJsonPath, `${JSON.stringify({ ...parsed, ...updates }, null, 2)}\n`, "utf-8");
+}
 async function execCompleteAdoption(args, deps) {
     const name = args.name;
     const handoffMessage = args.handoff_message;
@@ -148,7 +159,7 @@ async function execCompleteAdoption(args, deps) {
         return "error: missing required 'name' parameter";
     }
     if (!isPascalCase(name)) {
-        return `error: name '${name}' must be PascalCase (e.g. 'Slugger', 'MyAgent')`;
+        return `error: name '${name}' must be PascalCase (e.g. 'MyAgent', 'Hatchling')`;
     }
     // Validate psyche files exist
     const psycheDir = path.join(deps.tempDir, "psyche");
@@ -166,13 +177,36 @@ async function execCompleteAdoption(args, deps) {
     if (fs.existsSync(targetBundle)) {
         return `error: bundle '${name}.ouro' already exists at ${deps.bundlesRoot}. choose a different name.`;
     }
+    if (!deps.promptSecret) {
+        return "error: complete_adoption requires an interactive vault unlock secret prompt. Re-run `ouro hatch` in a terminal so the human can enter a hatchling vault unlock secret without echoing it.";
+    }
+    const vault = (0, identity_1.resolveVaultConfig)(name);
+    let vaultUnlockSecret;
+    try {
+        vaultUnlockSecret = await (0, vault_unlock_1.promptConfirmedVaultUnlockSecret)({
+            promptSecret: deps.promptSecret,
+            question: `Choose Ouro vault unlock secret for ${vault.email}: `,
+            confirmQuestion: `Confirm Ouro vault unlock secret for ${vault.email}: `,
+            emptyError: "hatchling vault creation requires an unlock secret. Re-run `ouro hatch` in an interactive terminal and enter a human-chosen unlock secret.",
+        });
+    }
+    catch (error) {
+        return `error: failed to read hatchling vault unlock secret: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`;
+    }
+    // Keep the bundle inert until vault/provider credentials are durably stored.
+    updateAgentConfig(deps.tempDir, { enabled: false, vault });
     // Scaffold structural dirs into tempDir
     scaffoldBundle(deps.tempDir);
     // Move tempDir -> final bundle location
     moveDir(deps.tempDir, targetBundle);
     // Write secrets
     try {
-        (0, hatch_flow_1.writeSecretsFile)(name, deps.provider, deps.credentials, deps.secretsRoot);
+        const vaultResult = await (0, vault_setup_1.createVaultAccount)(name, vault.serverUrl, vault.email, vaultUnlockSecret);
+        if (!vaultResult.success) {
+            throw new Error(`failed to create vault: ${vaultResult.error}`);
+        }
+        (0, vault_unlock_1.storeVaultUnlockSecret)({ agentName: name, email: vault.email, serverUrl: vault.serverUrl }, vaultUnlockSecret);
+        await (0, hatch_flow_1.storeHatchlingProviderCredentials)(name, deps.provider, deps.credentials);
     }
     catch (e) {
         // Rollback: remove the moved bundle
@@ -210,6 +244,7 @@ async function execCompleteAdoption(args, deps) {
         const friendPath = path.join(targetBundle, "friends", `${friendId}.json`);
         fs.writeFileSync(friendPath, JSON.stringify(friendRecord, null, 2), "utf-8");
     }
+    updateAgentConfig(targetBundle, { enabled: true });
     // Play hatch animation
     await (0, hatch_animation_1.playHatchAnimation)(name, deps.animationWriter);
     // Display handoff message