@ouro.bot/cli 0.1.0-alpha.71 → 0.1.0-alpha.710

package/dist/heart/cross-chat-delivery.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deliverCrossChatMessage = deliverCrossChatMessage;
-const types_1 = require("../mind/friends/types");
+const friends_1 = require("@ouro.bot/friends");
 const runtime_1 = require("../nerves/runtime");
 function buildPendingEnvelope(request, agentName, now) {
     return {
@@ -13,17 +13,18 @@ function buildPendingEnvelope(request, agentName, now) {
         timestamp: now,
     };
 }
-function queueForLater(request, deps, detail) {
+function queueForLater(request, deps, detail, rawStatus = "queued_for_later") {
     deps.queuePending(buildPendingEnvelope(request, deps.agentName, (deps.now ?? Date.now)()));
     return {
         status: "queued_for_later",
         detail,
+        ...(rawStatus !== "queued_for_later" ? { rawStatus } : {}),
     };
 }
 function isExplicitlyAuthorized(request) {
     return request.intent === "explicit_cross_chat"
         && Boolean(request.authorizingSession)
-        && (0, types_1.isTrustedLevel)(request.authorizingSession?.trustLevel);
+        && (0, friends_1.isTrustedLevel)(request.authorizingSession?.trustLevel);
 }
 async function deliverCrossChatMessage(request, deps) {
     (0, runtime_1.emitNervesEvent)({
@@ -38,31 +39,16 @@ async function deliverCrossChatMessage(request, deps) {
             authorizingTrustLevel: request.authorizingSession?.trustLevel ?? null,
         },
     });
-    if (request.intent === "generic_outreach") {
-        const result = queueForLater(request, deps, "generic outreach stays queued until the target session is next active");
-        (0, runtime_1.emitNervesEvent)({
-            component: "engine",
-            event: "engine.cross_chat_delivery_end",
-            message: "queued generic outreach for later delivery",
-            meta: {
-                friendId: request.friendId,
-                channel: request.channel,
-                key: request.key,
-                status: result.status,
-            },
-        });
-        return result;
-    }
-    if (!isExplicitlyAuthorized(request)) {
+    if (!isExplicitlyAuthorized(request) && request.intent !== "generic_outreach") {
         const result = {
             status: "blocked",
-            detail: "explicit cross-chat delivery requires a trusted asking session",
+            detail: "cross-chat delivery requires a trusted asking session or generic outreach intent",
         };
         (0, runtime_1.emitNervesEvent)({
             level: "warn",
             component: "engine",
             event: "engine.cross_chat_delivery_end",
-            message: "blocked explicit cross-chat delivery",
+            message: "blocked cross-chat delivery",
             meta: {
                 friendId: request.friendId,
                 channel: request.channel,
@@ -109,7 +95,7 @@ async function deliverCrossChatMessage(request, deps) {
             });
             return result;
         }
-        const result = queueForLater(request, deps, direct.detail.trim() || "live delivery unavailable right now; queued for the next active turn");
+        const result = queueForLater(request, deps, direct.detail.trim() || "live delivery unavailable right now; queued for the next active turn", direct.status);
         (0, runtime_1.emitNervesEvent)({
             component: "engine",
             event: "engine.cross_chat_delivery_end",

package/dist/heart/daemon/agent-config-check.js

@@ -0,0 +1,451 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vaultUnlockOrRecoverFix = vaultUnlockOrRecoverFix;
+exports.checkAgentConfig = checkAgentConfig;
+exports.checkAgentConfigWithProviderHealth = checkAgentConfigWithProviderHealth;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const identity_1 = require("../identity");
+const runtime_1 = require("../../nerves/runtime");
+const provider_models_1 = require("../provider-models");
+const provider_credentials_1 = require("../provider-credentials");
+const provider_readiness_cache_1 = require("../provider-readiness-cache");
+const vault_unlock_1 = require("../../repertoire/vault-unlock");
+const readiness_repair_1 = require("./readiness-repair");
+const provider_ping_progress_1 = require("./provider-ping-progress");
+const LANES = [
+    { lane: "outward", facing: "humanFacing" },
+    { lane: "inner", facing: "agentFacing" },
+];
+function isAgentProvider(value) {
+    return Object.prototype.hasOwnProperty.call(identity_1.PROVIDER_CREDENTIALS, value);
+}
+function agentRootFor(agentName, bundlesRoot) {
+    return path.join(bundlesRoot, `${agentName}.ouro`);
+}
+function configPathFor(agentName, bundlesRoot) {
+    return path.join(agentRootFor(agentName, bundlesRoot), "agent.json");
+}
+function laneForFacing(facing) {
+    return facing === "humanFacing" ? "outward" : "inner";
+}
+function resolveFacingProvider(parsed, facing, agentName, agentJsonPath) {
+    const raw = parsed[facing];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json for '${agentName}' is missing ${facing}.provider`,
+                fix: `Add ${facing}: { provider, model } to ${agentJsonPath}. Valid providers: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+            },
+        };
+    }
+    const provider = raw.provider;
+    if (typeof provider !== "string" || provider.length === 0) {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json for '${agentName}' is missing ${facing}.provider`,
+                fix: `Set ${facing}.provider in ${agentJsonPath}. Valid providers: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+            },
+        };
+    }
+    if (!isAgentProvider(provider)) {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `Unknown provider '${provider}' in ${facing}.provider for '${agentName}'`,
+                fix: `Set ${facing}.provider to one of: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+            },
+        };
+    }
+    const rawModel = raw.model;
+    const model = typeof rawModel === "string" && rawModel.trim().length > 0
+        ? rawModel.trim()
+        : (0, provider_models_1.getDefaultModelForProvider)(provider);
+    return { ok: true, selected: { facing, lane: laneForFacing(facing), provider, model } };
+}
+function validatePrivateRuntimeConfig(agentName, agentJsonPath, parsed) {
+    const privateRuntime = parsed.privateRuntime;
+    if (privateRuntime === undefined)
+        return null;
+    if (!privateRuntime || typeof privateRuntime !== "object" || Array.isArray(privateRuntime)) {
+        return {
+            ok: false,
+            error: `agent.json for '${agentName}' has invalid privateRuntime config; privateRuntime must be an object.`,
+            fix: `Use privateRuntime only for private-runtime policy such as { autoStart: false } in ${agentJsonPath}. Provider/model selection belongs to the inner lane: ouro use --agent ${agentName} --lane inner --provider <provider> --model <model>.`,
+        };
+    }
+    const privateRuntimeRecord = privateRuntime;
+    const forbidden = ["provider", "model"].filter((key) => Object.prototype.hasOwnProperty.call(privateRuntimeRecord, key));
+    if (forbidden.length === 0)
+        return null;
+    return {
+        ok: false,
+        error: `agent.json for '${agentName}' cannot set ${forbidden.map((key) => `privateRuntime.${key}`).join(" or ")}; privateRuntime cannot select providers or models.`,
+        fix: `Remove ${forbidden.map((key) => `privateRuntime.${key}`).join(" and ")} from ${agentJsonPath}. Provider/model selection belongs to the inner lane: ouro use --agent ${agentName} --lane inner --provider <provider> --model <model>.`,
+    };
+}
+function readAgentConfigForProviderCheck(agentName, bundlesRoot) {
+    const agentJsonPath = configPathFor(agentName, bundlesRoot);
+    let raw;
+    try {
+        raw = fs.readFileSync(agentJsonPath, "utf-8");
+    }
+    catch {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json not found at ${agentJsonPath}`,
+                fix: `Run 'ouro hatch ${agentName}' to create the agent bundle, or verify that ${bundlesRoot}/${agentName}.ouro/ exists.`,
+            },
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json at ${agentJsonPath} contains invalid JSON`,
+                fix: `Open ${agentJsonPath} and fix the JSON syntax.`,
+            },
+        };
+    }
+    if (parsed.enabled === false) {
+        return { ok: true, disabled: true, agentJsonPath, parsed };
+    }
+    const privateRuntimeError = validatePrivateRuntimeConfig(agentName, agentJsonPath, parsed);
+    if (privateRuntimeError)
+        return { ok: false, result: privateRuntimeError };
+    return { ok: true, disabled: false, agentJsonPath, parsed };
+}
+function readProviderSelectionForCheck(agentName, bundlesRoot) {
+    const configResult = readAgentConfigForProviderCheck(agentName, bundlesRoot);
+    if (!configResult.ok)
+        return { ok: false, result: configResult.result };
+    if (configResult.disabled)
+        return { ok: true, disabled: true };
+    const bindings = {};
+    for (const { lane, facing } of LANES) {
+        const selected = resolveFacingProvider(configResult.parsed, facing, agentName, configResult.agentJsonPath);
+        if (!selected.ok)
+            return { ok: false, result: selected.result };
+        bindings[lane] = selected.selected;
+    }
+    return {
+        ok: true,
+        disabled: false,
+        agentRoot: agentRootFor(agentName, bundlesRoot),
+        bindings,
+    };
+}
+function providerCredentialConfig(record) {
+    return {
+        ...record.credentials,
+        ...record.config,
+    };
+}
+function pingAttemptCount(result) {
+    if (Array.isArray(result.attempts))
+        return result.attempts.length;
+    return undefined;
+}
+function missingCredentialResult(agentName, lane, provider, model, credentialPath) {
+    return {
+        ok: false,
+        error: `${lane} provider ${provider} model ${model} has no credentials in ${agentName}'s vault at ${credentialPath}`,
+        fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to authenticate.`,
+        issue: (0, readiness_repair_1.providerCredentialMissingIssue)({
+            agentName,
+            lane,
+            provider,
+            model,
+            credentialPath,
+        }),
+    };
+}
+function isTransientVaultError(error) {
+    const normalized = error.toLowerCase();
+    return (normalized.includes("timed out") ||
+        normalized.includes("econnrefused") ||
+        normalized.includes("socket hang up") ||
+        normalized.includes("etimedout"));
+}
+function invalidPoolResult(agentName, lane, provider, model, pool) {
+    if (pool.reason === "unavailable" && isTransientVaultError(pool.error)) {
+        return {
+            ok: false,
+            error: `${lane} provider ${provider} model ${model} cannot read provider credentials from ${agentName}'s vault: ${pool.error}`,
+            fix: `Vault read timed out -- this usually resolves on retry. Run 'ouro up' again.`,
+        };
+    }
+    if (pool.reason === "unavailable" && isVaultLockedError(pool.error)) {
+        return {
+            ok: false,
+            error: `${lane} provider ${provider} model ${model} cannot read provider credentials because ${agentName}'s credential vault is locked on this machine.`,
+            fix: vaultUnlockOrRecoverFix(agentName),
+            issue: (0, readiness_repair_1.vaultLockedIssue)(agentName),
+        };
+    }
+    if (pool.reason === "unavailable" && (0, vault_unlock_1.isCredentialVaultNotConfiguredError)(pool.error)) {
+        return {
+            ok: false,
+            error: `${lane} provider ${provider} model ${model} cannot read provider credentials because ${agentName}'s credential vault is not configured in agent.json.`,
+            fix: (0, vault_unlock_1.vaultCreateRecoverFix)(agentName, `Then run 'ouro auth --agent ${agentName} --provider ${provider}' and rerun 'ouro up'.`),
+            issue: (0, readiness_repair_1.vaultUnconfiguredIssue)(agentName),
+        };
+    }
+    if (pool.reason === "invalid") {
+        return {
+            ok: false,
+            error: `${lane} provider ${provider} model ${model} cannot read provider credentials from ${agentName}'s vault at ${pool.poolPath}: ${pool.error}`,
+            fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to rewrite this provider credential, then run 'ouro up' again.`,
+        };
+    }
+    return {
+        ok: false,
+        error: `${lane} provider ${provider} model ${model} cannot read provider credentials from ${agentName}'s vault at ${pool.poolPath}: ${pool.error}`,
+        fix: vaultUnlockOrRecoverFix(agentName, `Then run 'ouro up' again. If the credential is missing or stale after unlock or recovery, run 'ouro auth --agent ${agentName} --provider ${provider}'.`),
+    };
+}
+function isVaultLockedError(error) {
+    const normalized = error.toLowerCase();
+    return /(?:ouro )?credential vault is locked|vault(?: is)? locked/.test(normalized);
+}
+function vaultUnlockOrRecoverFix(agentName, nextStep = "Then run 'ouro up' again.") {
+    return (0, vault_unlock_1.vaultUnlockReplaceRecoverFix)(agentName, nextStep);
+}
+function failedPingResult(agentName, lane, provider, model, result) {
+    return {
+        ok: false,
+        error: `${lane} provider ${provider} model ${model} failed live check: ${result.message}`,
+        fix: (0, readiness_repair_1.providerLiveCheckFix)({
+            agentName,
+            lane,
+            provider,
+            classification: result.classification,
+        }),
+        issue: (0, readiness_repair_1.providerLiveCheckFailedIssue)({
+            agentName,
+            lane,
+            provider,
+            model,
+            classification: result.classification,
+            message: result.message,
+        }),
+    };
+}
+function credentialRecordForLane(pool, provider) {
+    return pool.providers[provider];
+}
+function laneAudienceLabel(lane) {
+    return lane === "outward" ? "chat" : "inner lane";
+}
+function bindingLabel(binding) {
+    return `${binding.provider} / ${binding.model}`;
+}
+function selectedProviderPlan(agentName, bindings) {
+    return [
+        `${agentName}: checking the providers in agent.json`,
+        ...LANES.map(({ lane }) => `- ${laneAudienceLabel(lane)}: ${bindingLabel(bindings[lane])}`),
+    ].join("\n");
+}
+function selectedProvidersForBindings(bindings) {
+    return [...new Set(LANES.map(({ lane }) => bindings[lane].provider))];
+}
+function mapVaultRefreshProgress(agentName, onProgress) {
+    return (message) => {
+        if (message.startsWith("reading vault items for ")) {
+            onProgress(`${agentName}: opening saved provider credentials in the vault`);
+            return;
+        }
+        const providerRead = message.match(/^reading ([a-z0-9-]+) credentials\.\.\.$/i);
+        if (providerRead) {
+            onProgress(`${agentName}: reading saved ${providerRead[1]} credentials`);
+            return;
+        }
+        if (message === "parsing provider credentials...") {
+            onProgress(`${agentName}: organizing saved provider credentials`);
+        }
+    };
+}
+function providerPingSubject(agentName, lanes) {
+    const laneList = lanes.map((lane) => laneAudienceLabel(lane)).join(" + ");
+    return `${agentName} (${laneList})`;
+}
+/**
+ * Structural validation only. Live provider credential validation belongs to
+ * checkAgentConfigWithProviderHealth(), which reads the agent vault and pings.
+ */
+function checkAgentConfig(agentName, bundlesRoot) {
+    const selectionResult = readProviderSelectionForCheck(agentName, bundlesRoot);
+    if (!selectionResult.ok)
+        return selectionResult.result;
+    if (selectionResult.disabled)
+        return { ok: true };
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.agent_config_valid",
+        message: "agent config validation passed",
+        meta: {
+            agent: agentName,
+            providers: selectedProvidersForBindings(selectionResult.bindings),
+            liveProviderCheck: false,
+        },
+    });
+    return { ok: true };
+}
+async function checkAgentConfigWithProviderHealth(agentName, bundlesRoot, deps = {}) {
+    const selectionResult = readProviderSelectionForCheck(agentName, bundlesRoot);
+    if (!selectionResult.ok)
+        return selectionResult.result;
+    if (selectionResult.disabled)
+        return { ok: true };
+    const agentRoot = agentRootFor(agentName, bundlesRoot);
+    const shouldRecordReadiness = deps.recordReadiness !== false;
+    deps.onProgress?.(selectedProviderPlan(agentName, selectionResult.bindings));
+    const ping = deps.pingProvider ?? (await Promise.resolve().then(() => __importStar(require("../provider-ping")))).pingProvider;
+    const providers = selectedProvidersForBindings(selectionResult.bindings);
+    const poolResult = await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName, {
+        ...(deps.onProgress ? { onProgress: mapVaultRefreshProgress(agentName, deps.onProgress) } : {}),
+        providers,
+        preserveCachedOnFailure: true,
+    });
+    const pingGroups = new Map();
+    for (const { lane } of LANES) {
+        const binding = selectionResult.bindings[lane];
+        if (!poolResult.ok) {
+            if (poolResult.reason === "missing") {
+                return missingCredentialResult(agentName, lane, binding.provider, binding.model, poolResult.poolPath);
+            }
+            return invalidPoolResult(agentName, lane, binding.provider, binding.model, {
+                ...poolResult,
+                reason: poolResult.reason,
+            });
+        }
+        const record = credentialRecordForLane(poolResult.pool, binding.provider);
+        if (!record) {
+            return missingCredentialResult(agentName, lane, binding.provider, binding.model, poolResult.poolPath);
+        }
+        const key = `${binding.provider}\0${binding.model}\0${record.revision}`;
+        const group = pingGroups.get(key);
+        if (group) {
+            group.lanes.push(lane);
+        }
+        else {
+            pingGroups.set(key, {
+                provider: binding.provider,
+                model: binding.model,
+                record,
+                lanes: [lane],
+            });
+        }
+    }
+    const groups = [...pingGroups.values()];
+    const pingResults = await Promise.all(groups.map(async (group) => {
+        const result = await ping(group.provider, providerCredentialConfig(group.record), {
+            model: group.model,
+            ...(deps.providerPingOptions ?? {}),
+            ...(deps.onProgress
+                ? (0, provider_ping_progress_1.createProviderPingProgressReporter)({
+                    provider: group.provider,
+                    model: group.model,
+                    subject: providerPingSubject(agentName, group.lanes),
+                }, deps.onProgress)
+                : {}),
+        });
+        return { group, result };
+    }));
+    let firstFailure = null;
+    for (const { group, result } of pingResults) {
+        if (!result.ok) {
+            for (const lane of group.lanes) {
+                if (shouldRecordReadiness) {
+                    (0, provider_readiness_cache_1.recordProviderLaneReadiness)({
+                        agentRoot,
+                        agentName,
+                        lane,
+                        provider: group.provider,
+                        model: group.model,
+                        credentialRevision: group.record.revision,
+                        status: "failed",
+                        checkedAt: new Date().toISOString(),
+                        error: result.message,
+                        attempts: pingAttemptCount(result),
+                    });
+                }
+            }
+            firstFailure ??= failedPingResult(agentName, group.lanes[0], group.provider, group.model, result);
+            continue;
+        }
+        for (const lane of group.lanes) {
+            if (shouldRecordReadiness) {
+                (0, provider_readiness_cache_1.recordProviderLaneReadiness)({
+                    agentRoot,
+                    agentName,
+                    lane,
+                    provider: group.provider,
+                    model: group.model,
+                    credentialRevision: group.record.revision,
+                    status: "ready",
+                    checkedAt: new Date().toISOString(),
+                    attempts: pingAttemptCount(result),
+                });
+            }
+        }
+    }
+    if (firstFailure)
+        return firstFailure;
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.agent_config_valid",
+        message: "agent config validation passed",
+        meta: {
+            agent: agentName,
+            providers: [...new Set([...pingGroups.values()].map((group) => group.provider))],
+            liveProviderCheck: true,
+        },
+    });
+    return { ok: true };
+}