@ouro.bot/cli 0.1.0-alpha.894 → 0.1.0-alpha.895

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.895",
+      "changes": [
+        "The vault unlocks once per machine. Each agent's folder under ~/.ouro-cli/bitwarden/ now keeps one disposable bw profile per installed bw version (bw-<version>/), so machines with several bw installs never migrate or share one profile. When a local step fails on an authenticated profile (a null KdfConfig or missing master-password unlock data after a newer bw half-migrated it, or a missing session), Ouro moves the profile aside as data.json.discarded and logs in fresh once with the saved unlock secret, without asking the human. Server steps (login, sync), network errors, rate limits (429), gateway errors (502/504), connection resets, DNS and unreachable-network failures, lock contention and rejected secrets never discard a profile, and those network failures now count as transient. Ouro no longer deletes the saved Keychain/DPAPI/Secret Service/plaintext unlock entry when the vault rejects it: it keeps the entry and writes a private rejection record (mode 0600) in the agent's bw folder that every process honors, so no process retries a rejected secret against the server; `ouro vault unlock` (even with the same secret) or any successful login clears it. A store's terminal login failure is retried after 15 minutes instead of being held until restart. The locked-vault message also names a macOS password reset, which replaces the login keychain, as a cause. The Unraid template and the Sanctuary bundle runtime move to this version."
+      ]
+    },
     {
       "version": "0.1.0-alpha.894",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.894",
+  "runtimeVersion": "0.1.0-alpha.895",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.894</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.895</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/repertoire/bitwarden-store.js

@@ -43,6 +43,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BitwardenCredentialStore = void 0;
 exports.sanitizeCredentialErrorDetail = sanitizeCredentialErrorDetail;
+exports.readBwCliVersion = readBwCliVersion;
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -169,6 +170,7 @@ const BW_LOCK_STALE_MS = BW_LOCK_TIMEOUT_MS * 2;
 const BW_DATA_FILENAME = "data.json";
 const BW_SYNC_MARKER_FILENAME = ".ouro-last-sync";
 const BW_SYNC_FRESH_MS = 60_000;
+const BW_TERMINAL_LOGIN_ERROR_RETRY_MS = 15 * 60_000;
 /** In-process async mutex keyed by appDataDir. */
 const inProcessLocks = new Map();
 function isPidAlive(pid) {
@@ -365,6 +367,58 @@ function isBwNotInstalled(err) {
     const code = err.code;
     return code === "ENOENT" || /\bspawn\b.*\benoent\b/.test(msg) || msg.includes("command not found");
 }
+/**
+ * Read the installed @bitwarden/cli version from the package that owns the
+ * resolved `bw` binary. Returns null when the binary is not an npm install.
+ */
+function readBwCliVersion(bwBinaryPath) {
+    let dir;
+    try {
+        dir = path.dirname(fs.realpathSync(bwBinaryPath));
+    }
+    catch {
+        return null;
+    }
+    for (let depth = 0; depth < 4; depth++) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+            if (pkg.name === "@bitwarden/cli" && typeof pkg.version === "string")
+                return pkg.version;
+        }
+        catch {
+            // Keep walking up toward the package root.
+        }
+        dir = path.dirname(dir);
+    }
+    return null;
+}
+/** Another process holds the profile; the profile itself is not at fault. */
+function isBwLockTimeout(err) {
+    return err.message.includes("bw CLI lock timeout");
+}
+/**
+ * A local bw step (unlock of an already-authenticated profile) failed for a
+ * reason that says nothing about the vault server: the profile on disk is
+ * unusable. Network, lock and missing-binary failures are not this, and
+ * neither is a rejected unlock secret.
+ */
+class LocalProfileUnusableError extends Error {
+    localError;
+    constructor(localError) {
+        super(localError.message);
+        this.localError = localError;
+    }
+}
+function asLocalProfileFailure(err) {
+    if (isTransientError(err) || isBwNotInstalled(err) || isBwLockTimeout(err) || isBwInvalidUnlockSecretMessage(err.message)) {
+        return err;
+    }
+    return new LocalProfileUnusableError(err);
+}
+/** A bw version as a safe directory name component. */
+function bwProfileDirName(version) {
+    return `bw-${version.replace(/[^A-Za-z0-9._-]/g, "_")}`;
+}
 /** Check if the error is transient (network/timeout) and worth retrying. */
 function isTransientError(err) {
     const msg = err.message.toLowerCase();
@@ -372,7 +426,18 @@ function isTransientError(err) {
         msg.includes("etimedout") ||
         msg.includes("enotfound") ||
         msg.includes("socket hang up") ||
+        msg.includes("econnreset") ||
+        msg.includes("eai_again") ||
+        msg.includes("enetunreach") ||
+        msg.includes("ehostunreach") ||
+        msg.includes("fetch failed") ||
+        msg.includes("429") ||
+        msg.includes("too many requests") ||
+        msg.includes("502") ||
         msg.includes("503") ||
+        msg.includes("504") ||
+        msg.includes("bad gateway") ||
+        msg.includes("gateway timeout") ||
         msg.includes("server unavailable") ||
         msg.includes("timed out"));
 }
@@ -491,17 +556,22 @@ class BitwardenCredentialStore {
     serverUrl;
     email;
     masterPassword;
+    /** The agent's bw folder; each bw version keeps its own profile under it. */
+    agentDataDir;
+    /** The profile directory for the running bw version (BITWARDENCLI_APPDATA_DIR). */
     appDataDir;
     onInvalidUnlockSecret;
     onLoginSuccess;
     sessionToken = null;
     terminalLoginError = null;
+    terminalLoginErrorAt = 0;
     bwBinaryPath = "bw";
     structuredItemCache = null;
     constructor(serverUrl, email, masterPassword, options = {}) {
         this.serverUrl = serverUrl;
         this.email = email;
         this.masterPassword = masterPassword;
+        this.agentDataDir = options.appDataDir;
         this.appDataDir = options.appDataDir;
         this.onInvalidUnlockSecret = options.onInvalidUnlockSecret;
         this.onLoginSuccess = options.onLoginSuccess;
@@ -543,11 +613,21 @@ class BitwardenCredentialStore {
      */
     async login() {
         if (this.terminalLoginError) {
-            throw this.terminalLoginError;
+            // A long-lived process retries a terminal failure after a while instead
+            // of holding it until restart; rejected secrets are paused separately.
+            if (Date.now() - this.terminalLoginErrorAt < BW_TERMINAL_LOGIN_ERROR_RETRY_MS) {
+                throw this.terminalLoginError;
+            }
+            this.terminalLoginError = null;
         }
         // Ensure bw CLI is installed before any bw commands
         this.bwBinaryPath = await (0, bw_installer_1.ensureBwCli)();
-        if (this.appDataDir) {
+        if (this.agentDataDir) {
+            // Each bw version gets its own profile directory, so machines with
+            // several bw installs (one per Node version) never migrate or fight
+            // over one another's state.
+            const bwVersion = readBwCliVersion(this.bwBinaryPath);
+            this.appDataDir = bwVersion ? path.join(this.agentDataDir, bwProfileDirName(bwVersion)) : this.agentDataDir;
             fs.mkdirSync(this.appDataDir, { recursive: true, mode: 0o700 });
         }
         let lastError;
@@ -562,7 +642,7 @@ class BitwardenCredentialStore {
                 lastError = err instanceof Error ? err : new Error(String(err));
                 // Don't retry non-transient errors (auth failures, bw not installed)
                 if (!isTransientError(lastError)) {
-                    this.terminalLoginError = lastError;
+                    this.setTerminalLoginError(lastError);
                     if (isBwInvalidUnlockSecretMessage(lastError.message)) {
                         await this.notifyInvalidUnlockSecret(lastError);
                     }
@@ -581,15 +661,76 @@ class BitwardenCredentialStore {
                 await delay(backoffMs);
             }
         }
-        this.terminalLoginError = lastError;
+        this.setTerminalLoginError(lastError);
         /* v8 ignore next -- invalid unlock errors are non-transient and exit through the non-retry path above @preserve */
         if (isBwInvalidUnlockSecretMessage(lastError.message)) {
             await this.notifyInvalidUnlockSecret(lastError);
         }
         throw lastError;
     }
-    /** Single login attempt — called by login() retry loop. */
+    setTerminalLoginError(error) {
+        this.terminalLoginError = error;
+        this.terminalLoginErrorAt = Date.now();
+    }
+    /**
+     * Single login attempt — called by login() retry loop.
+     *
+     * The bw profile directory is a disposable cache; the durable secret is the
+     * machine's vault unlock material. When a local step fails on an
+     * authenticated profile (a corrupt or half-migrated profile, a missing
+     * session), the profile is moved aside and rebuilt with one fresh login.
+     * Server steps (login, sync), network failures, lock contention and
+     * rejected secrets never discard the profile, so a bad secret or a flaky
+     * server costs at most one server login per attempt.
+     */
     async loginAttempt() {
+        try {
+            await this.loginWithLocalProfile();
+        }
+        catch (error) {
+            if (!(error instanceof LocalProfileUnusableError))
+                throw error;
+            await this.discardLocalProfile(error.localError);
+            try {
+                await this.loginWithLocalProfile();
+            }
+            catch (retryError) {
+                throw retryError instanceof LocalProfileUnusableError ? retryError.localError : retryError;
+            }
+        }
+    }
+    /**
+     * Move the local bw profile aside so the next bw command starts from an
+     * empty profile. The previous data file is kept as one `.discarded` copy
+     * for diagnosis and is overwritten by the next discard.
+     */
+    async discardLocalProfile(cause) {
+        const appDataDir = this.appDataDir;
+        this.sessionToken = null;
+        this.structuredItemCache = null;
+        await withBwLock(appDataDir, async () => {
+            const dataPath = path.join(appDataDir, BW_DATA_FILENAME);
+            try {
+                fs.renameSync(dataPath, `${dataPath}.discarded`);
+            }
+            catch {
+                // Already gone: another process discarded it first, which is the same outcome.
+            }
+            fs.rmSync(path.join(appDataDir, BW_SYNC_MARKER_FILENAME), { force: true });
+        });
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "repertoire.bw_local_profile_discarded",
+            component: "repertoire",
+            message: "discarded unusable local bw profile; logging in fresh with the saved unlock secret",
+            meta: {
+                email: this.email,
+                serverUrl: this.serverUrl,
+                error: sanitizeCredentialErrorDetail(cause.message),
+            },
+        });
+    }
+    async loginWithLocalProfile() {
         let status = await this.readStatus();
         if (this.shouldRebuildLocalProfile(status)) {
             await this.rebuildLocalProfile("local bw profile did not match requested vault", status);
@@ -692,7 +833,12 @@ class BitwardenCredentialStore {
             const err = error;
             if (!isBwAlreadyLoggedInError(err))
                 throw err;
-            return this.execBwWithPasswordEnv(["unlock", "--raw"]);
+        }
+        try {
+            return await this.execBwWithPasswordEnv(["unlock", "--raw"]);
+        }
+        catch (error) {
+            throw asLocalProfileFailure(error);
         }
     }
     forgetLocalSyncMarker() {
@@ -754,7 +900,7 @@ class BitwardenCredentialStore {
         catch (error) {
             const err = error;
             if (!isBwInvalidUnlockSecretMessage(err.message))
-                throw err;
+                throw asLocalProfileFailure(err);
             await this.rebuildLocalProfile(reason, status, err);
             /* v8 ignore next -- defensive: rebuildLocalProfile always stores a string session token on success @preserve */
             return this.sessionToken ?? "";

package/dist/repertoire/credential-access.js

@@ -46,15 +46,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getCredentialStore = getCredentialStore;
 exports.probeCredentialVaultAccess = probeCredentialVaultAccess;
 exports.resetCredentialStore = resetCredentialStore;
-const crypto = __importStar(require("node:crypto"));
 const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const runtime_1 = require("../nerves/runtime");
 const identity = __importStar(require("../heart/identity"));
 const bitwarden_store_1 = require("./bitwarden-store");
 const vault_unlock_1 = require("./vault-unlock");
 let stores = new Map();
+function rejectedUnlockMessage(agentName, reason) {
+    return [
+        `The vault rejected the unlock secret saved on this machine for ${agentName} (${reason}).`,
+        "The saved secret was kept. If the vault's unlock secret changed, run",
+        `\`ouro vault unlock --agent ${agentName}\` once with the current secret.`,
+    ].join(" ");
+}
 function loadVaultSectionForAgent(agentName) {
     const configPath = path.join(identity.getAgentRoot(agentName), "agent.json");
     try {
@@ -65,14 +70,6 @@ function loadVaultSectionForAgent(agentName) {
         return { configPath };
     }
 }
-function bitwardenAppDataDir(agentName, vaultConfig, homeDir = os.homedir()) {
-    const digest = crypto
-        .createHash("sha256")
-        .update(`${agentName}:${vaultConfig.serverUrl}:${vaultConfig.email}`)
-        .digest("hex")
-        .slice(0, 24);
-    return path.join(homeDir, ".ouro-cli", "bitwarden", digest);
-}
 function getCredentialStore(agentNameInput) {
     const agentName = agentNameInput ?? identity.getAgentName();
     if (agentName === "SerpentGuide") {
@@ -87,6 +84,11 @@ function getCredentialStore(agentNameInput) {
     const cached = stores.get(cacheKey);
     if (cached)
         return cached;
+    const agentDataDir = (0, vault_unlock_1.bitwardenAppDataDir)(agentName, vaultConfig);
+    const rejection = (0, vault_unlock_1.readVaultUnlockRejection)(agentDataDir);
+    if (rejection) {
+        throw new Error(rejectedUnlockMessage(agentName, rejection.reason));
+    }
     const unlock = (0, vault_unlock_1.readVaultUnlockSecret)({
         agentName,
         email: vaultConfig.email,
@@ -94,25 +96,22 @@ function getCredentialStore(agentNameInput) {
     });
     const unlockConfig = { agentName, email: vaultConfig.email, serverUrl: vaultConfig.serverUrl };
     const unlockSource = unlock.source ?? unlockConfig;
-    let invalidUnlockCleared = false;
     let canonicalUnlockStored = false;
     const store = new bitwarden_store_1.BitwardenCredentialStore(vaultConfig.serverUrl, vaultConfig.email, unlock.secret, {
-        appDataDir: bitwardenAppDataDir(agentName, vaultConfig),
+        appDataDir: agentDataDir,
         onInvalidUnlockSecret: (error) => {
-            if (invalidUnlockCleared)
-                return;
-            invalidUnlockCleared = true;
-            (0, vault_unlock_1.clearVaultUnlockSecret)({
-                agentName,
-                email: unlockSource.email,
-                serverUrl: unlockSource.serverUrl,
-            });
+            // The vault rejected the saved secret. Keep the saved secret: deleting
+            // the only durable copy turns any misclassified bw or server error
+            // into a human prompt. Record the rejection on disk so no process
+            // retries it against the server; `ouro vault unlock` or any
+            // successful login clears the record.
             stores.delete(cacheKey);
+            (0, vault_unlock_1.recordVaultUnlockRejection)(agentDataDir, error.message);
             (0, runtime_1.emitNervesEvent)({
                 level: "warn",
-                event: "repertoire.credential_store_invalid_unlock_cleared",
+                event: "repertoire.credential_store_unlock_rejected",
                 component: "repertoire",
-                message: "cleared rejected local vault unlock material",
+                message: "vault rejected the saved local unlock secret; kept it and paused retries until a new secret is saved",
                 meta: {
                     agentName,
                     serverUrl: vaultConfig.serverUrl,
@@ -123,6 +122,7 @@ function getCredentialStore(agentNameInput) {
             });
         },
         onLoginSuccess: () => {
+            (0, vault_unlock_1.clearVaultUnlockRejection)(agentDataDir);
             if (canonicalUnlockStored)
                 return;
             if (unlockSource.serverUrl === vaultConfig.serverUrl && unlockSource.email === vaultConfig.email)
@@ -170,7 +170,11 @@ async function probeCredentialVaultAccess(agentNameInput, unlockSecret, options
         throw new Error((0, vault_unlock_1.credentialVaultNotConfiguredError)(agentName, configPath));
     }
     const vaultConfig = identity.resolveVaultConfig(agentName, vault);
-    const store = new bitwarden_store_1.BitwardenCredentialStore(vaultConfig.serverUrl, vaultConfig.email, unlockSecret, { appDataDir: bitwardenAppDataDir(agentName, vaultConfig, options.homeDir) });
+    const agentDataDir = (0, vault_unlock_1.bitwardenAppDataDir)(agentName, vaultConfig, options.homeDir);
+    const store = new bitwarden_store_1.BitwardenCredentialStore(vaultConfig.serverUrl, vaultConfig.email, unlockSecret, {
+        appDataDir: agentDataDir,
+        onLoginSuccess: () => (0, vault_unlock_1.clearVaultUnlockRejection)(agentDataDir),
+    });
     await store.get("__ouro_vault_probe__");
 }
 function resetCredentialStore() {

package/dist/repertoire/vault-unlock.js

@@ -42,6 +42,10 @@ exports.resolveVaultUnlockStore = resolveVaultUnlockStore;
 exports.noteVaultUnlockSelfHeal = noteVaultUnlockSelfHeal;
 exports.clearVaultUnlockSecret = clearVaultUnlockSecret;
 exports.readVaultUnlockSecret = readVaultUnlockSecret;
+exports.bitwardenAppDataDir = bitwardenAppDataDir;
+exports.readVaultUnlockRejection = readVaultUnlockRejection;
+exports.recordVaultUnlockRejection = recordVaultUnlockRejection;
+exports.clearVaultUnlockRejection = clearVaultUnlockRejection;
 exports.storeVaultUnlockSecret = storeVaultUnlockSecret;
 exports.getVaultUnlockStatus = getVaultUnlockStatus;
 const node_child_process_1 = require("node:child_process");
@@ -187,7 +191,7 @@ function lockedMessage(config, store) {
         "",
         "Provider credentials are still stored in the agent vault.",
         "This computer does not currently have usable local unlock material for that vault.",
-        "This can happen on a new computer, after a local profile or hostname migration, or if the local unlock entry was removed.",
+        "This can happen on a new computer, after a local profile or hostname migration, after a macOS password reset that replaced the login keychain, or if the local unlock entry was removed.",
         "",
         `Run \`${command}\` and enter the saved agent vault unlock secret from the human/operator who controls that vault.`,
         lostUnlockSecretGuidance(config),
@@ -587,6 +591,57 @@ function readVaultUnlockSecret(config, deps = {}) {
     });
     return { secret: loaded.secret, store, source: loaded.source };
 }
+const UNLOCK_REJECTED_FILENAME = ".ouro-unlock-rejected";
+/** The agent's bw folder under ~/.ouro-cli/bitwarden; bw profiles live beneath it. */
+function bitwardenAppDataDir(agentName, vaultConfig, homeDirValue = os.homedir()) {
+    const digest = crypto
+        .createHash("sha256")
+        .update(`${agentName}:${vaultConfig.serverUrl}:${vaultConfig.email}`)
+        .digest("hex")
+        .slice(0, 24);
+    return path.join(homeDirValue, ".ouro-cli", "bitwarden", digest);
+}
+/**
+ * The vault server rejected the saved unlock secret. Every process honors the
+ * record so none retries the same secret against the server; saving a secret
+ * or any successful login clears it.
+ */
+function readVaultUnlockRejection(agentDataDir) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(agentDataDir, UNLOCK_REJECTED_FILENAME), "utf8"));
+        return {
+            reason: typeof parsed.reason === "string" ? parsed.reason : "rejected",
+            rejectedAt: typeof parsed.rejectedAt === "string" ? parsed.rejectedAt : "",
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function recordVaultUnlockRejection(agentDataDir, reason, now = new Date()) {
+    fs.mkdirSync(agentDataDir, { recursive: true, mode: 0o700 });
+    const record = { reason, rejectedAt: now.toISOString() };
+    fs.writeFileSync(path.join(agentDataDir, UNLOCK_REJECTED_FILENAME), `${JSON.stringify(record)}\n`, { mode: 0o600 });
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        component: "repertoire",
+        event: "repertoire.vault_unlock_rejection_recorded",
+        message: "recorded that the vault rejected the saved unlock secret",
+        meta: { agentDataDir },
+    });
+}
+function clearVaultUnlockRejection(agentDataDir) {
+    const rejectionPath = path.join(agentDataDir, UNLOCK_REJECTED_FILENAME);
+    if (!fs.existsSync(rejectionPath))
+        return;
+    fs.rmSync(rejectionPath, { force: true });
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.vault_unlock_rejection_cleared",
+        message: "cleared the recorded vault unlock rejection",
+        meta: { agentDataDir },
+    });
+}
 function storeVaultUnlockSecret(config, secret, deps = {}) {
     const canonicalConfig = canonicalizeVaultUnlockConfig(config);
     const trimmed = secret.trim();
@@ -595,6 +650,9 @@ function storeVaultUnlockSecret(config, secret, deps = {}) {
     }
     const store = resolveVaultUnlockStore(canonicalConfig, deps);
     writeToStore(canonicalConfig, store, trimmed, deps);
+    if (canonicalConfig.agentName) {
+        clearVaultUnlockRejection(bitwardenAppDataDir(canonicalConfig.agentName, canonicalConfig, homeDir(deps)));
+    }
     (0, runtime_1.emitNervesEvent)({
         component: "repertoire",
         event: "repertoire.vault_unlock_stored",

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.894",
+  "version": "0.1.0-alpha.895",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.894",
+      "version": "0.1.0-alpha.895",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.894",
+  "version": "0.1.0-alpha.895",
   "engines": {
     "node": ">=22"
   },