@ouro.bot/cli 0.1.0-alpha.92 → 0.1.0-alpha.921

package/dist/heart/turn-context.js

@@ -0,0 +1,496 @@
+"use strict";
+/**
+ * TurnContext: a single pre-read snapshot of all state sources needed
+ * by the inbound-turn pipeline and prompt assembly.
+ *
+ * Before this module existed, pipeline.ts read ~10 state sources inline
+ * and prompt.ts did several ad-hoc filesystem reads. This centralizes
+ * all reads into one place so the rest of the turn is pure derivation.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSenseStatusLines = readSenseStatusLines;
+exports.buildTurnContext = buildTurnContext;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../nerves/runtime");
+const manager_1 = require("./bridges/manager");
+const identity_1 = require("./identity");
+const coding_1 = require("../repertoire/coding");
+const session_activity_1 = require("./session-activity");
+const thoughts_1 = require("./daemon/thoughts");
+const pending_1 = require("../mind/pending");
+const obligations_1 = require("../arc/obligations");
+const target_resolution_1 = require("./target-resolution");
+const episodes_1 = require("../arc/episodes");
+const cares_1 = require("../arc/cares");
+const config_1 = require("./config");
+const runtime_credentials_1 = require("./runtime-credentials");
+const daemon_health_1 = require("./daemon/daemon-health");
+const provider_visibility_1 = require("./provider-visibility");
+const mail_import_discovery_1 = require("./mail-import-discovery");
+const flight_recorder_1 = require("../arc/flight-recorder");
+const context_loss_sentinel_1 = require("./context-loss-sentinel");
+const shepherd_config_1 = require("./shepherd-config");
+// ── Helpers ─────────────────────────────────────────────────────────
+const DAEMON_SOCKET_PATH = "/tmp/ouroboros-daemon.sock";
+function isLiveCodingSessionStatus(status) {
+    return status === "spawning"
+        || status === "running"
+        || status === "waiting_input"
+        || status === "stalled";
+}
+function readInnerWorkState() {
+    const defaultJob = {
+        status: "idle",
+        content: null,
+        origin: null,
+        mode: "reflect",
+        obligationStatus: null,
+        surfacedResult: null,
+        queuedAt: null,
+        startedAt: null,
+        surfacedAt: null,
+    };
+    try {
+        const agentRoot = (0, identity_1.getAgentRoot)();
+        const pendingDir = (0, pending_1.getPrivateRuntimePendingDir)((0, identity_1.getAgentName)());
+        const sessionPath = (0, thoughts_1.getPrivateRuntimeSessionPath)(agentRoot);
+        const { pendingMessages, turns, runtimeState } = (0, thoughts_1.readPrivateRuntimeRawData)(sessionPath, pendingDir);
+        const dialogStatus = (0, thoughts_1.derivePrivateRuntimeStatus)(pendingMessages, turns, runtimeState);
+        const job = (0, thoughts_1.deriveInnerJob)(pendingMessages, turns, runtimeState);
+        const storeObligationPending = (0, obligations_1.readPendingObligations)(agentRoot).length > 0;
+        return {
+            status: dialogStatus.processing === "started" ? "running" : "idle",
+            hasPending: dialogStatus.queue !== "clear",
+            origin: dialogStatus.origin,
+            contentSnippet: dialogStatus.contentSnippet,
+            obligationPending: dialogStatus.obligationPending || storeObligationPending,
+            job,
+        };
+    }
+    catch { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        return {
+            status: "idle",
+            hasPending: false,
+            job: defaultJob,
+            /* v8 ignore stop */
+        };
+    }
+}
+function checkDaemonRunning() {
+    try {
+        return fs.existsSync(DAEMON_SOCKET_PATH);
+    }
+    catch { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        return false;
+        /* v8 ignore stop */
+    }
+}
+function hasTextField(record, key) {
+    return typeof record?.[key] === "string" && record[key].trim().length > 0;
+}
+function hasTrueField(record, key) {
+    return record?.[key] === true;
+}
+function hasOpenAIRealtimeVoiceConfig(options) {
+    return hasTextField(options.portableVoice, "openaiRealtimeApiKey")
+        || hasTextField(options.integrations, "openaiApiKey")
+        || hasTextField(options.integrations, "openaiEmbeddingsApiKey");
+}
+function recordOrUndefined(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function rawWorkbenchBundleEntryPresent() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join((0, identity_1.getAgentRoot)(), "agent.json"), "utf-8"));
+        const senses = recordOrUndefined(raw.senses);
+        const mcpServers = recordOrUndefined(raw.mcpServers);
+        const hasWorkbenchSense = senses
+            ? Object.prototype.hasOwnProperty.call(senses, "workbench")
+            : false;
+        const hasWorkbenchMcp = mcpServers
+            ? Object.prototype.hasOwnProperty.call(mcpServers, "ouro_workbench")
+            : false;
+        return hasWorkbenchSense || hasWorkbenchMcp;
+    }
+    catch {
+        return null;
+    }
+}
+function hasStaleWorkbenchBundleEntry(config) {
+    return rawWorkbenchBundleEntryPresent()
+        ?? (config.senses?.workbench?.enabled === true
+            || Object.prototype.hasOwnProperty.call(config.mcpServers ?? {}, "ouro_workbench"));
+}
+function readSenseStatusLines() {
+    const config = (0, identity_1.loadAgentConfig)();
+    const configuredSenses = config.senses ?? {};
+    const senses = {
+        ...configuredSenses,
+        cli: configuredSenses.cli ?? { enabled: true },
+        teams: configuredSenses.teams ?? { enabled: false },
+        bluebubbles: configuredSenses.bluebubbles ?? { enabled: false },
+        mail: configuredSenses.mail ?? { enabled: false },
+        voice: configuredSenses.voice ?? { enabled: false },
+        a2a: configuredSenses.a2a ?? { enabled: false },
+        telegram: configuredSenses.telegram ?? { enabled: false },
+        workbench: configuredSenses.workbench ?? { enabled: false },
+        shepherd: configuredSenses.shepherd ?? { enabled: false },
+    };
+    const payload = (0, config_1.loadConfig)();
+    const agentName = (0, identity_1.getAgentName)();
+    const runtimeConfig = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agentName);
+    const machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agentName);
+    const runtimePayload = runtimeConfig.ok ? runtimeConfig.config : {};
+    const machinePayload = machineRuntimeConfig.ok ? machineRuntimeConfig.config : {};
+    const teams = recordOrUndefined(runtimePayload.teams) ?? recordOrUndefined(payload.teams);
+    const bluebubbles = recordOrUndefined(machinePayload.bluebubbles) ?? recordOrUndefined(payload.bluebubbles);
+    const mailroom = recordOrUndefined(runtimePayload.mailroom) ?? recordOrUndefined(payload.mailroom);
+    const voice = recordOrUndefined(machinePayload.voice) ?? recordOrUndefined(payload.voice);
+    const portableVoice = recordOrUndefined(runtimePayload.voice) ?? recordOrUndefined(payload.voice);
+    const integrations = recordOrUndefined(runtimePayload.integrations) ?? recordOrUndefined(payload.integrations);
+    /* v8 ignore start -- voice readiness permutations are covered by voice runtime tests; turn-context keeps a compact status projection for prompts @preserve */
+    const voiceConversationEngine = (typeof voice?.twilioConversationEngine === "string" ? voice.twilioConversationEngine
+        : typeof voice?.conversationEngine === "string" ? voice.conversationEngine
+            : typeof portableVoice?.twilioConversationEngine === "string" ? portableVoice.twilioConversationEngine
+                : typeof portableVoice?.conversationEngine === "string" ? portableVoice.conversationEngine
+                    : "cascade").trim().toLowerCase();
+    const openAIRealtimeVoiceReady = hasOpenAIRealtimeVoiceConfig({ integrations, portableVoice });
+    const openAISipVoiceReady = openAIRealtimeVoiceReady
+        && (hasTextField(portableVoice, "openaiSipProjectId") || hasTextField(voice, "openaiSipProjectId"))
+        && (hasTrueField(portableVoice, "openaiSipAllowUnsignedWebhooks")
+            || hasTrueField(voice, "openaiSipAllowUnsignedWebhooks")
+            || hasTextField(portableVoice, "openaiSipWebhookSecret")
+            || hasTextField(voice, "openaiSipWebhookSecret"));
+    /* v8 ignore stop */
+    const cascadeVoiceReady = hasTextField(integrations, "elevenLabsApiKey")
+        && (hasTextField(integrations, "elevenLabsVoiceId") || hasTextField(portableVoice, "elevenLabsVoiceId"))
+        && hasTextField(voice, "whisperCliPath")
+        && hasTextField(voice, "whisperModelPath");
+    const privateKeys = mailroom?.privateKeys;
+    const workbenchHasStaleBundleEntry = hasStaleWorkbenchBundleEntry(config);
+    const configured = {
+        cli: true,
+        teams: hasTextField(teams, "clientId") && hasTextField(teams, "clientSecret") && hasTextField(teams, "tenantId"),
+        // Without a declared host account, every BlueBubbles send is refused, so it is not ready.
+        bluebubbles: hasTextField(bluebubbles, "serverUrl") && hasTextField(bluebubbles, "password")
+            && config.senses?.bluebubbles?.hostUsername !== undefined,
+        mail: hasTextField(mailroom, "mailboxAddress") && !!privateKeys && typeof privateKeys === "object" && !Array.isArray(privateKeys),
+        /* v8 ignore next 5 -- full voice mode matrix lives in the voice runtime resolver; this row only mirrors that result into prompt context @preserve */
+        voice: voiceConversationEngine === "openai-sip"
+            ? openAISipVoiceReady
+            : voiceConversationEngine === "openai-realtime"
+                ? openAIRealtimeVoiceReady
+                : cascadeVoiceReady,
+        a2a: true,
+        // Sanctuary's resident is deliberately tokenless: the root authority gateway holds the
+        // token, so a token in the resident's config would be the misconfiguration. Mirror the
+        // daemon's rule (sense-manager) instead of reporting a working sense as needs_config (D-047).
+        telegram: agentName === "sanctuary"
+            ? runtimeConfig.ok && machineRuntimeConfig.ok && !Object.hasOwn(runtimePayload, "telegramBotToken") && !Object.hasOwn(machinePayload, "telegramBotToken")
+            : hasTextField(runtimePayload, "telegramBotToken")
+                && hasTextField(runtimePayload, "telegramAuthorizedUserId")
+                && hasTextField(runtimePayload, "telegramAuthorizedChatId"),
+        workbench: false,
+        shepherd: (0, shepherd_config_1.shepherdSenseStatus)(true, machinePayload) === "ready",
+    };
+    const rows = [
+        { label: "CLI", status: "interactive" },
+        {
+            label: "Teams",
+            status: !senses.teams.enabled ? "disabled" : configured.teams ? "ready" : "needs_config",
+        },
+        {
+            label: "BlueBubbles",
+            status: !senses.bluebubbles.enabled ? "disabled" : configured.bluebubbles ? "ready" : "not_attached",
+        },
+        {
+            label: "Mail",
+            status: !senses.mail.enabled ? "disabled" : configured.mail ? "ready" : "needs_config",
+        },
+        {
+            label: "Voice",
+            status: !senses.voice.enabled ? "disabled" : configured.voice ? "ready" : "needs_config",
+        },
+        {
+            label: "A2A",
+            status: senses.a2a.enabled ? "ready" : "disabled",
+        },
+        {
+            label: "Telegram",
+            status: !senses.telegram.enabled ? "disabled" : configured.telegram ? "ready" : "needs_config",
+        },
+        {
+            label: "shepherd",
+            status: (0, shepherd_config_1.shepherdSenseStatus)(senses.shepherd.enabled, machinePayload),
+        },
+        {
+            label: "Workbench",
+            // Workbench can be injected at runtime (the Workbench app spawns
+            // `ouro mcp-serve --workbench-mcp` for its boss) with NO agent.json entry.
+            // A disabled/stale row here does NOT mean the tools are absent —
+            // the authoritative signal is whether `workbench_*` tools are in the
+            // toolset this turn. The annotation prevents the agent from misreading the
+            // row as "blocked".
+            status: workbenchHasStaleBundleEntry
+                ? "stale_bundle_entry (runtime-injected when launched by Workbench app; run ouro connect workbench to clean agent.json)"
+                : "disabled (runtime-injected when launched by Workbench app)",
+        },
+    ];
+    return rows.map((row) => `- ${row.label}: ${row.status}`);
+}
+function readBundleMetaFile() {
+    try {
+        const metaPath = path.join((0, identity_1.getAgentRoot)(), "bundle-meta.json");
+        const raw = fs.readFileSync(metaPath, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        return null;
+        /* v8 ignore stop */
+    }
+}
+function degradedFlightRecorderResume(issue) {
+    return {
+        schemaVersion: 1,
+        hasCompleteState: false,
+        canContinue: false,
+        missing: ["currentAsk", "nextSafeAction"],
+        gaps: [],
+        currentAsk: { value: null, confidence: "unknown", sourceEventIds: [] },
+        nextSafeAction: { value: null, stopBefore: [], sourceEventIds: [] },
+        blockedBecause: [],
+        activeObligationIds: [],
+        activeReturnObligationIds: [],
+        activePacketIds: [],
+        openEvolutionCaseIds: [],
+        recentClaimIds: [],
+        unverifiedClaimIds: [],
+        lastSafeCheckpoint: { turnId: null, sessionRef: null, recordedAt: null, sourceEventIds: [] },
+        recorderHealth: { status: "degraded", issues: [issue] },
+    };
+}
+function degradedRecoverySentinel(issue) {
+    return {
+        schemaVersion: 1,
+        latest: null,
+        latestReady: null,
+        history: [],
+        degraded: { issues: [issue] },
+    };
+}
+// ── Builder ─────────────────────────────────────────────────────────
+async function buildTurnContext(input) {
+    const agentRoot = (0, identity_1.getAgentRoot)();
+    const agentName = (0, identity_1.getAgentName)();
+    // Sync config
+    let syncConfig = { enabled: false, remote: "origin" };
+    try {
+        syncConfig = (0, config_1.getSyncConfig)();
+    }
+    catch { /* v8 ignore next -- defensive @preserve */ /* config not available */ }
+    // Bridges
+    const activeBridges = (0, manager_1.createBridgeManager)().findBridgesForSession({
+        friendId: input.currentSession.friendId,
+        channel: input.currentSession.channel,
+        key: input.currentSession.key,
+    });
+    // Session activity
+    let sessionActivity = [];
+    try {
+        sessionActivity = (0, session_activity_1.listSessionActivity)({
+            sessionsDir: `${agentRoot}/state/sessions`,
+            friendsDir: `${agentRoot}/friends`,
+            agentName,
+            currentSession: {
+                friendId: input.currentSession.friendId,
+                channel: input.currentSession.channel,
+                key: input.currentSession.key,
+            },
+        });
+    }
+    catch { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        sessionActivity = [];
+        /* v8 ignore stop */
+    }
+    // Target candidates
+    let targetCandidates = [];
+    try {
+        if (input.channel !== "inner") {
+            targetCandidates = await (0, target_resolution_1.listTargetSessionCandidates)({
+                sessionsDir: `${agentRoot}/state/sessions`,
+                friendsDir: `${agentRoot}/friends`,
+                agentName,
+                currentSession: {
+                    friendId: input.currentSession.friendId,
+                    channel: input.currentSession.channel,
+                    key: input.currentSession.key,
+                },
+                friendStore: input.friendStore,
+            });
+        }
+    }
+    catch { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        targetCandidates = [];
+        /* v8 ignore stop */
+    }
+    // Pending obligations
+    let pendingObligations = [];
+    try {
+        pendingObligations = (0, obligations_1.readPendingObligations)(agentRoot);
+    }
+    catch { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        pendingObligations = [];
+        /* v8 ignore stop */
+    }
+    // Coding sessions
+    let codingSessions = [];
+    let otherCodingSessions = [];
+    try {
+        const liveCodingSessions = (0, coding_1.getCodingSessionManager)()
+            .listSessions()
+            .filter((session) => isLiveCodingSessionStatus(session.status) && Boolean(session.originSession));
+        codingSessions = liveCodingSessions.filter((session) => session.originSession?.friendId === input.currentSession.friendId
+            && session.originSession.channel === input.currentSession.channel
+            && session.originSession.key === input.currentSession.key);
+        otherCodingSessions = liveCodingSessions.filter((session) => !(session.originSession?.friendId === input.currentSession.friendId
+            && session.originSession.channel === input.currentSession.channel
+            && session.originSession.key === input.currentSession.key));
+    }
+    catch { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        codingSessions = [];
+        otherCodingSessions = [];
+        /* v8 ignore stop */
+    }
+    const backgroundOperations = (0, mail_import_discovery_1.listVisibleBackgroundOperations)({
+        agentName,
+        agentRoot,
+        repoRoot: process.cwd(),
+        homeDir: process.env.HOME,
+        nowMs: Date.now(),
+        limit: 5,
+        includeAmbientDiscovery: input.includeAmbientBackgroundDiscovery,
+    });
+    // Private-runtime work state
+    const innerWorkState = readInnerWorkState();
+    // Return obligations
+    let returnObligations = [];
+    try {
+        returnObligations = (0, obligations_1.listActiveReturnObligations)(agentName);
+    }
+    catch { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        returnObligations = [];
+        /* v8 ignore stop */
+    }
+    // Recent episodes
+    const recentEpisodes = (0, episodes_1.readRecentEpisodes)(agentRoot, { limit: 20 });
+    // Active cares
+    const activeCares = (0, cares_1.readActiveCares)(agentRoot);
+    // ── Prompt-assembly pre-reads ──────────────────────────────────────
+    const daemonRunning = checkDaemonRunning();
+    let senseStatusLines = [];
+    try {
+        senseStatusLines = readSenseStatusLines();
+    }
+    catch { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        senseStatusLines = [];
+        /* v8 ignore stop */
+    }
+    const bundleMeta = readBundleMetaFile();
+    const providerVisibility = (0, provider_visibility_1.buildAgentProviderVisibility)({ agentName, agentRoot });
+    let daemonHealth = null;
+    try {
+        daemonHealth = (0, daemon_health_1.readHealth)((0, daemon_health_1.getDefaultHealthPath)());
+    }
+    catch { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        daemonHealth = null;
+        /* v8 ignore stop */
+    }
+    let flightRecorderResume;
+    try {
+        flightRecorderResume = (0, flight_recorder_1.readFlightRecorderResume)(agentRoot);
+    }
+    catch (error) { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        const reason = error instanceof Error ? error.message : String(error);
+        flightRecorderResume = degradedFlightRecorderResume(`flight recorder read failed: ${reason}`);
+        /* v8 ignore stop */
+    }
+    let recoverySentinel;
+    try {
+        recoverySentinel = (0, context_loss_sentinel_1.readContextLossSentinelView)(agentRoot, { limit: 5 });
+    }
+    catch (error) { /* v8 ignore start -- defensive: fallback on read failure @preserve */
+        const reason = error instanceof Error ? error.message : String(error);
+        recoverySentinel = degradedRecoverySentinel(`Recovery Sentinel read failed: ${reason}`);
+        /* v8 ignore stop */
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.turn_context_built",
+        message: "turn context snapshot assembled",
+        meta: {
+            channel: input.channel,
+            obligationCount: pendingObligations.length,
+            bridgeCount: activeBridges.length,
+            codingSessionCount: codingSessions.length,
+            backgroundOperationCount: backgroundOperations.length,
+            episodeCount: recentEpisodes.length,
+            providerLaneCount: providerVisibility.lanes.length,
+        },
+    });
+    return {
+        activeBridges,
+        sessionActivity,
+        targetCandidates,
+        pendingObligations,
+        codingSessions,
+        otherCodingSessions,
+        backgroundOperations,
+        innerWorkState,
+        returnObligations,
+        recentEpisodes,
+        activeCares,
+        syncConfig,
+        syncFailure: undefined, // Set by pipeline after preTurnPull
+        providerVisibility,
+        daemonRunning,
+        senseStatusLines,
+        bundleMeta,
+        daemonHealth,
+        flightRecorderResume,
+        recoverySentinel,
+    };
+}

package/dist/heart/turn-execution-lease.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withTurnExecutionLease = withTurnExecutionLease;
+const node_async_hooks_1 = require("node:async_hooks");
+const runtime_1 = require("../nerves/runtime");
+const leaseContext = new node_async_hooks_1.AsyncLocalStorage();
+let queueTail = Promise.resolve();
+async function withTurnExecutionLease(work) {
+    if (leaseContext.getStore())
+        return work();
+    let release;
+    const previous = queueTail;
+    queueTail = new Promise((resolve) => {
+        release = resolve;
+    });
+    await previous;
+    (0, runtime_1.emitNervesEvent)({
+        component: "heart",
+        event: "heart.turn_execution_lease_acquired",
+        message: "turn execution lease acquired",
+    });
+    return leaseContext.run(true, async () => {
+        try {
+            return await work();
+        }
+        finally {
+            release();
+        }
+    });
+}

package/dist/heart/{daemon → versioning}/ouro-bot-global-installer.js

@@ -38,7 +38,7 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
-const runtime_metadata_1 = require("./runtime-metadata");
+const runtime_metadata_1 = require("../daemon/runtime-metadata");
 function normalizeOutput(output) {
     return (typeof output === "string" ? output : output.toString("utf-8")).trim();
 }
@@ -98,12 +98,13 @@ function syncGlobalOuroBotWrapper(deps = {}) {
     const globalRoot = resolveGlobalRoot(execFileSyncImpl);
     const installedVersion = readInstalledWrapperVersion(globalRoot, existsSyncImpl, readFileSyncImpl);
     const executableOwner = resolveExecutableOwner(globalPrefix, platform, existsSyncImpl, realpathSyncImpl);
-    if (executableOwner === "wrapper") {
+    const installTarget = `ouro.bot@${runtimeVersion}`;
+    if (executableOwner === "wrapper" && installedVersion === runtimeVersion) {
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: "daemon.ouro_bot_global_sync_end",
             message: "global ouro.bot wrapper already current",
-            meta: { version: runtimeVersion, installedVersion, executableOwner, installed: false },
+            meta: { version: runtimeVersion, installedVersion, executableOwner, installed: false, installTarget },
         });
         return {
             installed: false,
@@ -112,12 +113,12 @@ function syncGlobalOuroBotWrapper(deps = {}) {
             executableOwner,
         };
     }
-    execFileSyncImpl("npm", ["install", "-g", "--force", "ouro.bot@latest"], { stdio: "pipe", encoding: "utf-8" });
+    execFileSyncImpl("npm", ["install", "-g", "--force", installTarget], { stdio: "pipe", encoding: "utf-8" });
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.ouro_bot_global_sync_end",
         message: "global ouro.bot wrapper synced",
-        meta: { version: runtimeVersion, installedVersion, executableOwner, installed: true },
+        meta: { version: runtimeVersion, installedVersion, executableOwner, installed: true, installTarget },
     });
     return {
         installed: true,

package/dist/heart/{daemon → versioning}/ouro-bot-wrapper.js

@@ -34,8 +34,9 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runOuroBotWrapper = runOuroBotWrapper;
+const cli_arg_redaction_1 = require("../daemon/cli-arg-redaction");
 const runtime_1 = require("../../nerves/runtime");
-const daemon_cli_1 = require("./daemon-cli");
+const daemon_cli_1 = require("../daemon/daemon-cli");
 async function defaultLoadCanonicalRunner() {
     // Use the subpath export so we get the daemon-cli module directly,
     // NOT the root entry point which has side-effects (immediately runs the CLI).
@@ -57,7 +58,7 @@ async function runOuroBotWrapper(args, deps = {}) {
         component: "daemon",
         event: "daemon.ouro_bot_wrapper_start",
         message: "starting ouro.bot wrapper delegation",
-        meta: { args },
+        meta: { args: (0, cli_arg_redaction_1.redactCliArgs)(args) },
     });
     const loadCanonicalRunner = deps.loadCanonicalRunner ?? defaultLoadCanonicalRunner;
     const fallbackRunCli = deps.fallbackRunCli ?? daemon_cli_1.runOuroCli;