@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.830

package/dist/heart/daemon/readiness-repair.js

@@ -0,0 +1,365 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vaultLockedIssue = vaultLockedIssue;
+exports.vaultUnconfiguredIssue = vaultUnconfiguredIssue;
+exports.providerCredentialMissingIssue = providerCredentialMissingIssue;
+exports.providerLiveCheckFix = providerLiveCheckFix;
+exports.preferredConnectRepairAction = preferredConnectRepairAction;
+exports.providerLiveCheckFailedIssue = providerLiveCheckFailedIssue;
+exports.genericReadinessIssue = genericReadinessIssue;
+exports.isKnownReadinessIssue = isKnownReadinessIssue;
+exports.renderReadinessIssue = renderReadinessIssue;
+exports.renderReadinessIssueNextSteps = renderReadinessIssueNextSteps;
+exports.runGuidedReadinessRepair = runGuidedReadinessRepair;
+const runtime_1 = require("../../nerves/runtime");
+const human_readiness_1 = require("./human-readiness");
+const human_command_screens_1 = require("./human-command-screens");
+function vaultLockedIssue(agentName) {
+    return {
+        kind: "vault-locked",
+        severity: "blocked",
+        actor: "human-required",
+        summary: `${agentName}: vault locked`,
+        detail: "Pick the path that matches what the human actually has. Ouro will not print or store the unlock secret as a portable file.",
+        actions: [
+            {
+                kind: "vault-unlock",
+                label: "Unlock with saved secret",
+                command: `ouro vault unlock --agent ${agentName}`,
+                actor: "human-required",
+            },
+            {
+                kind: "vault-replace",
+                label: "Create empty replacement vault",
+                command: `ouro vault replace --agent ${agentName}`,
+                actor: "human-required",
+            },
+            {
+                kind: "vault-recover",
+                label: "Recover from JSON export",
+                command: `ouro vault recover --agent ${agentName} --from <json>`,
+                actor: "human-required",
+                executable: false,
+            },
+        ],
+    };
+}
+function vaultUnconfiguredIssue(agentName) {
+    return {
+        kind: "vault-unconfigured",
+        severity: "blocked",
+        actor: "human-required",
+        summary: `${agentName}: vault not configured`,
+        detail: "This bundle does not have a vault locator in agent.json yet. Create the agent vault before authenticating providers.",
+        actions: [
+            {
+                kind: "vault-create",
+                label: "Create this agent's vault",
+                command: `ouro vault create --agent ${agentName}`,
+                actor: "human-required",
+            },
+            {
+                kind: "vault-recover",
+                label: "Recover from JSON export",
+                command: `ouro vault recover --agent ${agentName} --from <json>`,
+                actor: "human-required",
+                executable: false,
+            },
+        ],
+    };
+}
+function providerCredentialMissingIssue(input) {
+    return {
+        kind: "provider-credentials-missing",
+        severity: "blocked",
+        actor: "human-required",
+        summary: `${input.agentName}: missing ${input.provider} credentials (${input.lane}, ${input.model})`,
+        detail: `source: ${input.credentialPath}`,
+        actions: [
+            {
+                kind: "provider-auth",
+                label: `Authenticate ${input.provider}`,
+                command: `ouro auth --agent ${input.agentName} --provider ${input.provider}`,
+                actor: "human-required",
+                provider: input.provider,
+            },
+            {
+                kind: "provider-use",
+                label: "Choose another provider/model",
+                command: `ouro use --agent ${input.agentName} --lane ${input.lane} --provider <provider> --model <model>`,
+                actor: "human-choice",
+                executable: false,
+                lane: input.lane,
+            },
+        ],
+    };
+}
+function normalizeProviderLiveCheckClassification(classification) {
+    switch (classification) {
+        case "auth-failure":
+        case "usage-limit":
+        case "rate-limit":
+        case "server-error":
+        case "network-error":
+        case "unknown":
+            return classification;
+        default:
+            return "unknown";
+    }
+}
+function providerUseAction(input) {
+    return {
+        kind: "provider-use",
+        label: "Choose a different working provider/model",
+        command: `ouro use --agent ${input.agentName} --lane ${input.lane} --provider <provider> --model <model>`,
+        actor: "human-choice",
+        executable: false,
+        lane: input.lane,
+    };
+}
+function providerAuthAction(input) {
+    return {
+        kind: "provider-auth",
+        label: `Refresh ${input.provider} credentials`,
+        command: `ouro auth --agent ${input.agentName} --provider ${input.provider}`,
+        actor: "human-required",
+        provider: input.provider,
+    };
+}
+function providerRetryAction(input) {
+    return {
+        kind: "provider-retry",
+        label: input.label,
+        command: `ouro repair --agent ${input.agentName}`,
+        actor: "human-choice",
+        executable: false,
+    };
+}
+function providerLiveCheckFix(input) {
+    const classification = normalizeProviderLiveCheckClassification(input.classification);
+    const authCommand = `ouro auth --agent ${input.agentName} --provider ${input.provider}`;
+    const useCommand = `ouro use --agent ${input.agentName} --lane ${input.lane} --provider <provider> --model <model>`;
+    switch (classification) {
+        case "auth-failure":
+            return `Run '${authCommand}' to refresh credentials, or run '${useCommand}' to choose another provider/model for this lane.`;
+        case "usage-limit":
+            return `This usually means ${input.provider} hit a usage limit. Restore quota, then run 'ouro up' again. Or run '${useCommand}' to choose another provider/model for this lane.`;
+        case "rate-limit":
+            return `Run 'ouro up' again after a short wait. Or run '${useCommand}' to choose another provider/model for this lane.`;
+        case "server-error":
+            return `Run 'ouro up' again in a moment. If ${input.provider} keeps failing, run '${useCommand}' to choose another provider/model for this lane.`;
+        case "network-error":
+            return `Check the network or provider availability, then run 'ouro up' again. Or run '${useCommand}' to choose another provider/model for this lane.`;
+        case "unknown":
+            return `Run 'ouro up' again. If it keeps failing, run '${authCommand}' to refresh credentials or '${useCommand}' to choose another provider/model for this lane.`;
+    }
+}
+function providerLiveCheckActions(input) {
+    const classification = normalizeProviderLiveCheckClassification(input.classification);
+    const useAction = providerUseAction(input);
+    const authAction = providerAuthAction(input);
+    switch (classification) {
+        case "auth-failure":
+            return [authAction, useAction];
+        case "usage-limit":
+            return [
+                providerRetryAction({ agentName: input.agentName, label: "After restoring quota, check again" }),
+                useAction,
+            ];
+        case "rate-limit":
+            return [
+                providerRetryAction({ agentName: input.agentName, label: "Give it a minute, then check again" }),
+                useAction,
+            ];
+        case "server-error":
+            return [
+                providerRetryAction({ agentName: input.agentName, label: "Check again in a moment" }),
+                useAction,
+            ];
+        case "network-error":
+            return [
+                providerRetryAction({ agentName: input.agentName, label: "Check again after the network settles" }),
+                useAction,
+                authAction,
+            ];
+        case "unknown":
+            return [
+                providerRetryAction({ agentName: input.agentName, label: "Check again" }),
+                authAction,
+                useAction,
+            ];
+    }
+}
+function preferredConnectRepairAction(issue) {
+    if (!issue)
+        return undefined;
+    if (issue.kind === "provider-live-check-failed" && issue.actions[0]?.kind === "provider-retry") {
+        return issue.actions.find((action) => action.kind !== "provider-retry") ?? issue.actions[0];
+    }
+    return issue.actions[0];
+}
+function providerLiveCheckFailedIssue(input) {
+    return {
+        kind: "provider-live-check-failed",
+        severity: "blocked",
+        actor: "human-choice",
+        summary: `${input.agentName}: ${input.lane} provider ${input.provider} / ${input.model} failed live check`,
+        detail: input.message,
+        actions: providerLiveCheckActions(input),
+    };
+}
+function genericReadinessIssue(input) {
+    return {
+        kind: "generic",
+        severity: "degraded",
+        actor: "human-choice",
+        summary: input.summary,
+        ...(input.detail ? { detail: input.detail } : {}),
+        actions: input.fix
+            ? [{
+                    kind: "provider-use",
+                    label: "Follow the printed fix",
+                    command: input.fix,
+                    actor: "human-choice",
+                    executable: false,
+                }]
+            : [],
+    };
+}
+function isKnownReadinessIssue(issue) {
+    return !!issue && issue.kind !== "generic";
+}
+function renderReadinessIssue(issue) {
+    const lines = [issue.summary];
+    if (issue.detail) {
+        lines.push(`  ${issue.detail}`);
+    }
+    if (issue.actions.length > 0) {
+        lines.push("");
+    }
+    issue.actions.forEach((action, index) => {
+        if (index > 0)
+            lines.push("");
+        lines.push(`${index + 1}. ${action.label}`);
+        lines.push(`   ${action.command}`);
+    });
+    if (issue.actions.length > 0) {
+        lines.push("");
+    }
+    lines.push(`${issue.actions.length + 1}. Skip for now`);
+    return lines.join("\n");
+}
+function renderReadinessIssueNextSteps(issue) {
+    const lines = [issue.summary];
+    if (issue.detail && issue.kind !== "vault-locked") {
+        lines.push(`  ${issue.detail}`);
+    }
+    issue.actions.forEach((action, index) => {
+        lines.push(`  ${index === 0 ? "next" : "or"}: ${action.command}`);
+    });
+    return lines;
+}
+function selectedActionFor(answer, issue) {
+    const selected = Number.parseInt(answer.trim(), 10);
+    if (!Number.isFinite(selected))
+        return null;
+    if (selected === issue.actions.length + 1)
+        return "skip";
+    if (selected < 1 || selected > issue.actions.length)
+        return null;
+    /* v8 ignore next -- defensive: bounds were checked above, but keep sparse arrays harmless @preserve */
+    return issue.actions[selected - 1] ?? null;
+}
+function isExecutableAction(action) {
+    if (action.executable === false)
+        return false;
+    return !action.command.includes("<");
+}
+async function runGuidedReadinessRepair(reports, deps) {
+    (0, runtime_1.emitNervesEvent)({
+        level: "info",
+        component: "daemon",
+        event: "daemon.readiness_repair_start",
+        message: "guided readiness repair started",
+        meta: { reportCount: reports.length },
+    });
+    let repairsAttempted = false;
+    for (const report of reports) {
+        if (report.ok || report.issues.length === 0)
+            continue;
+        for (const issue of report.issues) {
+            if (deps.isTTY) {
+                const snapshot = (0, human_readiness_1.buildHumanReadinessSnapshot)({
+                    agent: report.agent,
+                    title: `Repair ${report.agent}`,
+                    items: [
+                        (0, human_readiness_1.readinessItemFromIssue)(issue, {
+                            key: `${report.agent}:${issue.kind}`,
+                            title: issue.summary,
+                        }),
+                    ],
+                });
+                deps.writeStdout((0, human_command_screens_1.renderHumanReadinessBoard)({
+                    agent: report.agent,
+                    title: `Repair ${report.agent}`,
+                    subtitle: "Choose the path that matches what the human actually has.",
+                    snapshot,
+                    isTTY: true,
+                    columns: deps.stdoutColumns,
+                    prompt: `Choose [1-${issue.actions.length + 1}]: `,
+                }).trimEnd());
+            }
+            else {
+                deps.writeStdout(renderReadinessIssue(issue));
+            }
+            if (!deps.promptInput) {
+                deps.writeStdout(`manual repair required for ${report.agent}; run one of the commands above.`);
+                continue;
+            }
+            const answer = await deps.promptInput(`Choose [1-${issue.actions.length + 1}]: `);
+            const action = selectedActionFor(answer, issue);
+            if (action === "skip") {
+                deps.writeStdout(`skipped ${report.agent} for now.`);
+                continue;
+            }
+            if (!action) {
+                deps.writeStdout(`invalid choice for ${report.agent}; no repair attempted.`);
+                continue;
+            }
+            if (!isExecutableAction(action)) {
+                deps.writeStdout(`manual step for ${report.agent}: ${action.command}`);
+                continue;
+            }
+            if (!deps.runRepairAction) {
+                deps.writeStdout(`repair runner unavailable for ${report.agent}; run \`${action.command}\` manually.`);
+                continue;
+            }
+            try {
+                deps.onActionAttempted?.(report.agent, action, issue);
+                await deps.runRepairAction(report.agent, action, issue);
+                repairsAttempted = true;
+                deps.writeStdout(`repair step finished for ${report.agent}.`);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                repairsAttempted = true;
+                deps.writeStdout(`repair error for ${report.agent}: ${message}`);
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "daemon",
+                    event: "daemon.readiness_repair_error",
+                    message: "guided readiness repair action failed",
+                    meta: { agent: report.agent, issue: issue.kind, action: action.kind, error: message },
+                });
+            }
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        level: "info",
+        component: "daemon",
+        event: "daemon.readiness_repair_end",
+        message: "guided readiness repair completed",
+        meta: { repairsAttempted },
+    });
+    return { repairsAttempted };
+}

package/dist/heart/daemon/run-hooks.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runHooks = runHooks;
 const runtime_1 = require("../../nerves/runtime");
 const bundle_meta_1 = require("./hooks/bundle-meta");
+const agent_config_v2_1 = require("./hooks/agent-config-v2");
 async function runHooks(deps) {
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -12,6 +13,7 @@ async function runHooks(deps) {
     });
     try {
         deps.registerUpdateHook(bundle_meta_1.bundleMetaHook);
+        deps.registerUpdateHook(agent_config_v2_1.agentConfigV2Hook);
         const currentVersion = deps.getPackageVersion();
         await deps.applyPendingUpdates(deps.bundlesRoot, currentVersion);
         (0, runtime_1.emitNervesEvent)({

package/dist/heart/daemon/runtime-logging.js

@@ -37,8 +37,10 @@ exports.configureDaemonRuntimeLogger = configureDaemonRuntimeLogger;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const nerves_1 = require("../../nerves");
+const friends_1 = require("@ouro.bot/friends");
 const runtime_1 = require("../../nerves/runtime");
 const identity_1 = require("../identity");
+const ouro_version_manager_1 = require("../versioning/ouro-version-manager");
 const LEGACY_SHARED_RUNTIME_LOGGING = {
     level: "info",
     sinks: ["terminal", "ndjson"],
@@ -50,7 +52,13 @@ function defaultLoggingForProcess(processName) {
             sinks: ["ndjson"],
         };
     }
-    if (processName === "bluebubbles") {
+    if (processName === "telegram") {
+        return {
+            level: "info",
+            sinks: ["terminal", "ndjson"],
+        };
+    }
+    if (processName === "bluebubbles" || processName === "mail" || processName === "voice" || processName === "a2a") {
         return {
             level: "warn",
             sinks: ["terminal", "ndjson"],
@@ -99,38 +107,62 @@ function resolveRuntimeLoggingConfig(configPath, processName) {
         sinks,
     };
 }
-function resolveAgentNameForPaths(explicit) {
-    if (explicit && explicit.trim().length > 0)
-        return explicit.trim();
+function machineDaemonLoggingConfigPath(homeDir) {
+    return path.join((0, ouro_version_manager_1.getOuroCliHome)(homeDir), "daemon", "logging.json");
+}
+function machineDaemonLogsDir(homeDir) {
+    return path.join((0, ouro_version_manager_1.getOuroCliHome)(homeDir), "daemon", "logs");
+}
+function resolveLoggingPathTarget(explicit) {
+    if (explicit && explicit.trim().length > 0) {
+        return { kind: "agent", agentName: explicit.trim() };
+    }
     try {
-        return (0, identity_1.getAgentName)();
+        return { kind: "agent", agentName: (0, identity_1.getAgentName)() };
     }
     catch {
-        return "slugger";
+        return { kind: "machine" };
     }
 }
 function configureDaemonRuntimeLogger(processName, options = {}) {
-    const agentName = resolveAgentNameForPaths(options.agentName);
+    const pathTarget = resolveLoggingPathTarget(options.agentName);
     const configPath = options.configPath
-        ?? (options.homeDir
-            ? path.join(options.homeDir, "AgentBundles", `${agentName}.ouro`, "state", "daemon", "logging.json")
-            : (0, identity_1.getAgentDaemonLoggingConfigPath)(agentName));
+        ?? (pathTarget.kind === "machine"
+            ? machineDaemonLoggingConfigPath(options.homeDir)
+            : options.homeDir
+                ? path.join(options.homeDir, "AgentBundles", `${pathTarget.agentName}.ouro`, "state", "daemon", "logging.json")
+                : (0, identity_1.getAgentDaemonLoggingConfigPath)(pathTarget.agentName));
     const config = resolveRuntimeLoggingConfig(configPath, processName);
-    const logsDir = options.homeDir
-        ? path.join(options.homeDir, "AgentBundles", `${agentName}.ouro`, "state", "daemon", "logs")
-        : (0, identity_1.getAgentDaemonLogsDir)(agentName);
+    const logsDir = pathTarget.kind === "machine"
+        ? machineDaemonLogsDir(options.homeDir)
+        : options.homeDir
+            ? path.join(options.homeDir, "AgentBundles", `${pathTarget.agentName}.ouro`, "state", "daemon", "logs")
+            : (0, identity_1.getAgentDaemonLogsDir)(pathTarget.agentName);
+    // Rotation policy per daemon ndjson stream (Unit 1c):
+    //   25 MB threshold x 5 gzipped generations = ~30 MB peak per stream.
+    // Call sites previously relied on the implicit 50 MB default; we now pass
+    // the options object explicitly so the policy is visible at the call site.
     const sinks = config.sinks.map((sinkName) => {
         if (sinkName === "terminal") {
             return (0, nerves_1.createTerminalSink)();
         }
         const ndjsonPath = path.join(logsDir, `${processName}.ndjson`);
-        return (0, nerves_1.createNdjsonFileSink)(ndjsonPath);
+        return (0, nerves_1.createNdjsonFileSink)(ndjsonPath, {
+            maxSizeBytes: 25 * 1024 * 1024,
+            maxGenerations: 5,
+            compress: true,
+        });
     });
     const logger = (0, nerves_1.createLogger)({
         level: config.level,
         sinks,
     });
     (0, runtime_1.setRuntimeLogger)(logger);
+    // Wire the @ouro.bot/friends package's observability seam to the harness's real
+    // nerves emitter. The package ships a no-op emitNervesEvent by default; this
+    // injection forwards the extracted friend model's events into harness nerves so
+    // observability isn't lost when friends moved out of the tree. Idempotent.
+    (0, friends_1.setNervesEmitter)(runtime_1.emitNervesEvent);
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.runtime_logger_configured",
@@ -140,6 +172,7 @@ function configureDaemonRuntimeLogger(processName, options = {}) {
             level: config.level,
             sinks: config.sinks,
             configPath,
+            pathTarget,
         },
     });
 }

package/dist/heart/daemon/runtime-metadata.js

@@ -36,7 +36,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRuntimeMetadata = getRuntimeMetadata;
 const crypto_1 = require("crypto");
 const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const childProcess = __importStar(require("child_process"));
 const identity_1 = require("../identity");
@@ -87,19 +86,7 @@ function readLastUpdated(repoRoot, packageJsonPath, statSyncImpl, execFileSyncIm
         return { value: UNKNOWN_METADATA, source: "unknown" };
     }
 }
-function readHomeDir() {
-    const homedirImpl = optionalFunction(os, "homedir");
-    if (!homedirImpl) {
-        return null;
-    }
-    try {
-        return homedirImpl.call(os);
-    }
-    catch {
-        return null;
-    }
-}
-function listConfigTargets(bundlesRoot, secretsRoot, daemonLoggingPath, readdirSyncImpl) {
+function listConfigTargets(bundlesRoot, daemonLoggingPath, readdirSyncImpl) {
     if (!readdirSyncImpl)
         return [];
     const targets = new Set();
@@ -117,19 +104,6 @@ function listConfigTargets(bundlesRoot, secretsRoot, daemonLoggingPath, readdirS
     catch {
         // ignore unreadable bundle roots
     }
-    if (secretsRoot) {
-        try {
-            const secretEntries = readdirSyncImpl(secretsRoot, { withFileTypes: true });
-            for (const entry of secretEntries) {
-                if (!entry.isDirectory())
-                    continue;
-                targets.add(path.join(secretsRoot, entry.name, "secrets.json"));
-            }
-        }
-        catch {
-            // ignore unreadable secrets roots
-        }
-    }
     return [...targets].sort();
 }
 function readConfigFingerprint(targets, readFileSyncImpl, existsSyncImpl) {
@@ -172,8 +146,6 @@ function readConfigFingerprint(targets, readFileSyncImpl, existsSyncImpl) {
 function getRuntimeMetadata(deps = {}) {
     const repoRoot = deps.repoRoot ?? (0, identity_1.getRepoRoot)();
     const bundlesRoot = deps.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
-    const homeDir = readHomeDir();
-    const secretsRoot = deps.secretsRoot ?? (homeDir ? path.join(homeDir, ".agentsecrets") : null);
     const daemonLoggingPath = deps.daemonLoggingPath ?? (0, identity_1.getAgentDaemonLoggingConfigPath)();
     const readFileSyncImpl = deps.readFileSync ?? optionalFunction(fs, "readFileSync")?.bind(fs) ?? null;
     const statSyncImpl = deps.statSync ?? optionalFunction(fs, "statSync")?.bind(fs) ?? null;
@@ -191,7 +163,7 @@ function getRuntimeMetadata(deps = {}) {
             throw new Error("git unavailable");
         }))
         : { value: UNKNOWN_METADATA, source: "unknown" };
-    const configTargets = listConfigTargets(bundlesRoot, secretsRoot, daemonLoggingPath, readdirSyncImpl);
+    const configTargets = listConfigTargets(bundlesRoot, daemonLoggingPath, readdirSyncImpl);
     const configFingerprint = readConfigFingerprint(configTargets, readFileSyncImpl, existsSyncImpl);
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",

package/dist/heart/daemon/runtime-mode.js

@@ -50,11 +50,22 @@ function detectRuntimeMode(rootPath, deps = {}) {
         });
         return "production";
     }
+    const isWorktree = rootPath.includes(".claude/worktrees/");
+    const isGitRepo = checkExists(path.join(rootPath, ".git"));
+    if (!isWorktree && !isGitRepo && checkExists(path.join(rootPath, "container-runtime.json"))) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.runtime_mode_detected",
+            message: "detected runtime mode",
+            meta: { rootPath, mode: "production", reason: "container-runtime" },
+        });
+        return "production";
+    }
     // 2-4. Everything else is dev: worktrees, git repos, unknown paths
     // (conservative default: assume dev unless proven production)
-    const reason = rootPath.includes(".claude/worktrees/")
+    const reason = isWorktree
         ? "worktree"
-        : checkExists(path.join(rootPath, ".git"))
+        : isGitRepo
             ? "git-repo"
             : "unknown";
     (0, runtime_1.emitNervesEvent)({