@ouro.bot/cli 0.1.0-alpha.907 → 0.1.0-alpha.908

package/changelog.json

@@ -1,6 +1,15 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.908",
+      "changes": [
+        "Vault commands use the Bitwarden CLI that ships with ouro (pinned 2026.6.0) instead of whichever bw is first on PATH. bw 2026.9 runs a user key id migration on sign-in that our Vaultwarden server answers with 404, so ouro vault unlock and create failed on machines with a newer global bw.",
+        "The bundled bw runs under ouro's own Node, so it works with no node on PATH and on Windows. A missing bundled bw is logged as repertoire.bw_cli_bundled_missing before ouro falls back to PATH, and the fallback npm install uses the same pinned version.",
+        "OURO_BW_BINARY names a specific bw to use ahead of the bundled one, for tests and unusual installs; ouro refuses it with a clear error when it is not an executable file.",
+        "ouro vault unlock now shows each step while it checks vault access: which bw it uses, pointing bw at the server, signing in or unlocking, syncing, and any retry with its reason."
+      ]
+    },
     {
       "version": "0.1.0-alpha.907",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.907",
+  "runtimeVersion": "0.1.0-alpha.908",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.907</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.908</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/cli-exec.js

@@ -773,7 +773,7 @@ function createHumanCommandProgress(deps, commandName) {
 async function runCommandProgressPhase(progress, label, run, detail) {
     progress.startPhase(label);
     try {
-        const result = await Promise.resolve(run());
+        const result = await Promise.resolve(run((step) => progress.updateDetail(step)));
         progress.completePhase(label, detail(result));
         return result;
     }
@@ -1809,7 +1809,7 @@ async function executeVaultUnlock(command, deps) {
     const progress = createHumanCommandProgress(deps, "vault unlock");
     let store;
     try {
-        await runCommandProgressPhase(progress, "checking vault access", () => (0, credential_access_1.probeCredentialVaultAccess)(command.agent, unlockSecret, { homeDir: deps.homeDir }), () => "ok");
+        await runCommandProgressPhase(progress, "checking vault access", (report) => (0, credential_access_1.probeCredentialVaultAccess)(command.agent, unlockSecret, { homeDir: deps.homeDir, onProgress: report }), () => "ok");
         store = await runCommandProgressPhase(progress, "saving local unlock", () => (0, vault_unlock_1.storeVaultUnlockSecret)({
             agentName: command.agent,
             email: vault.email,

package/dist/repertoire/bitwarden-store.js

@@ -341,7 +341,8 @@ function execBw(args, sessionToken, appDataDir, stdin, bwBinaryPath = "bw", extr
         ...extraEnv,
     };
     const runCommand = (lock) => new Promise((resolve, reject) => {
-        const child = (0, node_child_process_1.execFile)(bwBinaryPath, args, { timeout: BW_COMMAND_TIMEOUT_MS, env }, (err, stdout, stderr) => {
+        const command = (0, bw_installer_1.bwCommand)(bwBinaryPath, args);
+        const child = (0, node_child_process_1.execFile)(command.file, command.args, { timeout: BW_COMMAND_TIMEOUT_MS, env }, (err, stdout, stderr) => {
             if (err) {
                 if (isBwNotInstalled(err)) {
                     reject(new Error("bw CLI not found. Install from https://bitwarden.com/help/cli/"));
@@ -562,6 +563,7 @@ class BitwardenCredentialStore {
     appDataDir;
     onInvalidUnlockSecret;
     onLoginSuccess;
+    onProgress;
     sessionToken = null;
     terminalLoginError = null;
     terminalLoginErrorAt = 0;
@@ -575,6 +577,7 @@ class BitwardenCredentialStore {
         this.appDataDir = options.appDataDir;
         this.onInvalidUnlockSecret = options.onInvalidUnlockSecret;
         this.onLoginSuccess = options.onLoginSuccess;
+        this.onProgress = options.onProgress;
     }
     isReady() {
         return true;
@@ -621,12 +624,14 @@ class BitwardenCredentialStore {
             this.terminalLoginError = null;
         }
         // Ensure bw CLI is installed before any bw commands
+        this.onProgress?.("finding the Bitwarden CLI");
         this.bwBinaryPath = await (0, bw_installer_1.ensureBwCli)();
+        const bwVersion = readBwCliVersion(this.bwBinaryPath);
+        this.onProgress?.(`using bw ${bwVersion ?? "(unknown version)"} at ${this.bwBinaryPath}`);
         if (this.agentDataDir) {
             // Each bw version gets its own profile directory, so machines with
             // several bw installs (one per Node version) never migrate or fight
             // over one another's state.
-            const bwVersion = readBwCliVersion(this.bwBinaryPath);
             this.appDataDir = bwVersion ? path.join(this.agentDataDir, bwProfileDirName(bwVersion)) : this.agentDataDir;
             fs.mkdirSync(this.appDataDir, { recursive: true, mode: 0o700 });
         }
@@ -658,6 +663,7 @@ class BitwardenCredentialStore {
                     message: `bw login attempt ${attempt + 1} failed, retrying in ${backoffMs}ms`,
                     meta: { attempt: attempt + 1, backoffMs, reason: lastError.message },
                 });
+                this.onProgress?.(`sign-in attempt ${attempt + 1} failed (${lastError.message.split("\n")[0].slice(0, 120)}); retrying in ${Math.round(backoffMs / 1000)}s`);
                 await delay(backoffMs);
             }
         }
@@ -731,6 +737,7 @@ class BitwardenCredentialStore {
         });
     }
     async loginWithLocalProfile() {
+        this.onProgress?.("reading the local bw profile");
         let status = await this.readStatus();
         if (this.shouldRebuildLocalProfile(status)) {
             await this.rebuildLocalProfile("local bw profile did not match requested vault", status);
@@ -739,6 +746,7 @@ class BitwardenCredentialStore {
         // Configure server URL if needed (only works when logged out)
         if (status.status === "unauthenticated" || !status.serverUrl) {
             try {
+                this.onProgress?.(`pointing bw at ${this.serverUrl}`);
                 await this.execBw(["config", "server", this.serverUrl]);
             }
             catch (error) {
@@ -750,6 +758,7 @@ class BitwardenCredentialStore {
             }
         }
         if (!this.sessionToken) {
+            this.onProgress?.(status.status === "unauthenticated" || !status.status ? `signing in to ${this.serverUrl} as ${this.email}` : `unlocking ${this.email}`);
             if (status.status === "locked") {
                 // Already logged in, just needs unlock.
                 const unlockOutput = await this.execWithLocalProfileRebuild("unlock rejected saved local unlock material", status, () => this.execBwWithPasswordEnv(["unlock", "--raw"]));
@@ -766,6 +775,7 @@ class BitwardenCredentialStore {
             }
         }
         if (this.shouldSyncVaultAfterSession(status)) {
+            this.onProgress?.("syncing vault items");
             /* v8 ignore next -- defensive: loginAttempt always sets sessionToken before sync @preserve */
             await this.execBw(["sync"], this.sessionToken ?? undefined);
             this.writeSyncMarker();

package/dist/repertoire/bw-installer.js

@@ -2,8 +2,10 @@
 /**
  * Lazy bw CLI installer — auto-installs the Bitwarden CLI when not present.
  *
- * Mirrors the whisper-cpp pattern in senses/bluebubbles/media.ts:
- * check PATH first, install via npm if missing, emit nerves event.
+ * Prefers the Bitwarden CLI that ships with ouro (the `@bitwarden/cli` version pinned in our
+ * package.json), because a newer `bw` on PATH can run client migrations our Vaultwarden server
+ * does not support: bw 2026.9 posts a user key id that Vaultwarden 1.37 answers with 404, and its
+ * login then fails. PATH is the fallback, then an npm install of the same pinned version.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -39,8 +41,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PINNED_BW_CLI_VERSION = void 0;
 exports.findExecutableOnPath = findExecutableOnPath;
 exports.findExecutableViaNpmPrefix = findExecutableViaNpmPrefix;
+exports.findBundledBwCli = findBundledBwCli;
+exports.bwCommand = bwCommand;
 exports.ensureBwCli = ensureBwCli;
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
@@ -49,6 +54,8 @@ const runtime_1 = require("../nerves/runtime");
 const INSTALL_TIMEOUT_MS = 120_000;
 const WHICH_TIMEOUT_MS = 5_000;
 const DEFAULT_WINDOWS_PATHEXT = ".EXE;.CMD;.BAT;.COM";
+/** Must match the `@bitwarden/cli` dependency in package.json (a test checks). */
+exports.PINNED_BW_CLI_VERSION = "2026.6.0";
 function execFileAsync(cmd, args, timeout) {
     return new Promise((resolve, reject) => {
         (0, node_child_process_1.execFile)(cmd, args, { timeout }, (err, stdout) => {
@@ -134,16 +141,60 @@ async function findExecutableViaNpmPrefix(command, platform = process.platform,
     return null;
 }
 /**
- * Ensure the `bw` CLI is available, installing it via npm if needed.
- * Returns the path to the `bw` binary.
+ * The `bw` entry point (`build/bw.js`) of the `@bitwarden/cli` package installed with ouro, or
+ * null when it is missing. It is run with ouro's own Node (see `bwCommand`), so it needs neither
+ * an executable bit nor `node` on PATH, and works on Windows too.
  */
-async function ensureBwCli() {
-    // 1. Check if bw is already in PATH
+function findBundledBwCli(resolvePackageJson = (id) => require.resolve(id)) {
+    try {
+        const packageJsonPath = resolvePackageJson("@bitwarden/cli/package.json");
+        const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+        const bin = typeof pkg.bin === "string" ? pkg.bin : (pkg.bin && typeof pkg.bin === "object" ? pkg.bin.bw : undefined);
+        if (typeof bin !== "string")
+            throw new Error("@bitwarden/cli package.json names no bw entry point");
+        const entry = path.join(path.dirname(packageJsonPath), bin);
+        if (!fs.existsSync(entry))
+            throw new Error(`bundled bw entry point is missing: ${entry}`);
+        return entry;
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "repertoire.bw_cli_bundled_missing",
+            component: "repertoire",
+            message: "the bw that ships with ouro was not found; falling back to bw on PATH",
+            meta: { reason: error instanceof Error ? error.message : String(error) },
+        });
+        return null;
+    }
+}
+/** How to spawn a resolved `bw`: a `.js` entry point runs under this Node, anything else directly. */
+function bwCommand(bwBinaryPath, args, nodePath = process.execPath) {
+    return bwBinaryPath.endsWith(".js") ? { file: nodePath, args: [bwBinaryPath, ...args] } : { file: bwBinaryPath, args };
+}
+/**
+ * Ensure the `bw` CLI is available: `OURO_BW_BINARY` when set, else the bundled pinned one, else
+ * one on PATH, else install the pinned version via npm. Returns the path to the `bw` binary.
+ */
+async function ensureBwCli(findBundled = findBundledBwCli) {
+    // 0. An explicit override (tests and unusual installs): OURO_BW_BINARY
+    const override = process.env.OURO_BW_BINARY?.trim();
+    if (override) {
+        if (findExecutableOnPath(override))
+            return override;
+        throw new Error(`OURO_BW_BINARY is set to ${override}, which is not an executable file`);
+    }
+    // 1. The bw that ships with ouro
+    const bundled = findBundled();
+    if (bundled) {
+        return bundled;
+    }
+    // 2. A bw already on PATH
     const existing = findExecutableOnPath("bw");
     if (existing) {
         return existing;
     }
-    // 2. Install via npm
+    // 3. Install the pinned version via npm
     (0, runtime_1.emitNervesEvent)({
         event: "repertoire.bw_cli_install_start",
         component: "repertoire",
@@ -151,7 +202,7 @@ async function ensureBwCli() {
         meta: {},
     });
     try {
-        await execFileAsync("npm", ["install", "-g", "@bitwarden/cli"], INSTALL_TIMEOUT_MS);
+        await execFileAsync("npm", ["install", "-g", `@bitwarden/cli@${exports.PINNED_BW_CLI_VERSION}`], INSTALL_TIMEOUT_MS);
     }
     catch (err) {
         /* v8 ignore next -- execFileCb always throws Error instances @preserve */
@@ -165,7 +216,7 @@ async function ensureBwCli() {
         });
         throw new Error(`failed to install bw CLI via npm: ${reason}`);
     }
-    // 3. Verify installation and return path
+    // 4. Verify installation and return path
     const installed = findExecutableOnPath("bw") ?? await findExecutableViaNpmPrefix("bw");
     if (installed) {
         (0, runtime_1.emitNervesEvent)({

package/dist/repertoire/credential-access.js

@@ -174,6 +174,7 @@ async function probeCredentialVaultAccess(agentNameInput, unlockSecret, options
     const store = new bitwarden_store_1.BitwardenCredentialStore(vaultConfig.serverUrl, vaultConfig.email, unlockSecret, {
         appDataDir: agentDataDir,
         onLoginSuccess: () => (0, vault_unlock_1.clearVaultUnlockRejection)(agentDataDir),
+        onProgress: options.onProgress,
     });
     await store.get("__ouro_vault_probe__");
 }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.907",
+  "version": "0.1.0-alpha.908",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.907",
+      "version": "0.1.0-alpha.908",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.907",
+  "version": "0.1.0-alpha.908",
   "engines": {
     "node": ">=22"
   },