algo-cli-runtime 0.16.0__tar.gz → 0.18.0__tar.gz

{algo_cli_runtime-0.16.0 → algo_cli_runtime-0.18.0}/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to Algo CLI are documented here. The format follows [Keep a
 
 ## [Unreleased]
 
+## [0.18.0] - 2026-07-17
+
+### Added
+
+- ActionSpec tools, commands, providers, and kernels are materialized as retrievable `runtime_capability` records with policy, prerequisites, compatibility, and known limitations.
+- The harness retrieval benchmark now includes frozen multilingual, code-switching, translated-alias, multi-hop, cross-source, and temporal-supersession workloads with recall@k, MRR, nDCG, citation precision, and a fixture digest.
+- Harness status reports privacy-safe external-store adapter availability, indexed provenance, deterministic conflict policy, and malformed or unavailable extra-root diagnostics.
+- Operations guides cover external stores, provider authentication recovery, runtime capability indexing, and the truthful Echo Veil activation contract.
+
+### Changed
+
+- A 10/10 score now requires the versioned multilingual/complex retrieval-quality payload and its metric thresholds in addition to the existing stability and reusable-index performance evidence.
+- Superseded knowledge remains explicitly searchable but is excluded from automatic context injection.
+
+### Fixed
+
+- Invalidated ChatGPT/Codex OAuth sessions attempt one bounded refresh and otherwise clear unusable access state with actionable reauthentication guidance.
+- Runtime readiness uses exact loopback host parsing and a short synchronized negative cache; timed-out web fetches release only semaphore permits owned by their request.
+- Terminal configuration errors suggest the closest valid subcommand instead of falling through or failing ambiguously.
+
+## [0.17.0] - 2026-07-15
+
+### Added
+
+- A terminal-first `algo-cli config` workflow provides redacted provider status, guided setup, authentication, verification, and cleanup without crowding the interactive slash-command palette.
+- Google Workspace setup now guides Desktop-app OAuth configuration and launches the PKCE loopback login flow from the normal terminal.
+
+### Changed
+
+- xAI model and X-search access now use the documented `XAI_API_KEY` route; legacy local xAI OAuth state is detected for migration but is no longer used by the runtime.
+- ChatGPT/Codex, Google, and xAI setup guidance is consistent across startup diagnostics, provider routing, slash commands, README documentation, and the website install page.
+
+### Security
+
+- OAuth token persistence and refresh are process-serialized to prevent concurrent refresh-token rotation races, and remote credential-bearing endpoint overrides require HTTPS.
+- Shell timeouts terminate descendant process groups, timed-out web fetches have a bounded concurrency budget, and X-search cache metadata is normalized against multiline injection.
+- Runtime state loading tolerates corrupt or unreadable JSON, rejects invalid environment keys safely, preserves private file modes, and avoids unbounded lock-file growth.
+
+### Fixed
+
+- `algo-cli config setup google` now executes the requested setup instead of falling through into the interactive agent runtime.
+- Invalid Google redirect-port settings fall back safely, cache-write failures no longer discard valid X-search results, and OAuth error redaction preserves useful HTTP status codes while removing credentials and callback codes.
+
 ## [0.16.0] - 2026-07-14
 
 ### Added

{algo_cli_runtime-0.16.0 → algo_cli_runtime-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: algo-cli-runtime
-Version: 0.16.0
+Version: 0.18.0
 Summary: Agent runtime for tools, durable context, and verified work
 Project-URL: Homepage, https://algo-cli.com
 Project-URL: Documentation, https://algo-cli.com/docs
@@ -110,7 +110,8 @@ algo-cli --model qwen3:235b-cloud
 export OLLAMA_API_KEY="..."
 algo-cli --cloud --model qwen3
 
-# ChatGPT/Codex subscription (authenticate once with /chatgpt-login)
+# ChatGPT/Codex subscription (authenticate once outside the chat REPL)
+algo-cli config setup chatgpt
 algo-cli --model gpt-5.6-sol
 # Short aliases also work: sol, terra, luna
 algo-cli --model terra
@@ -125,19 +126,29 @@ Signed-in local Ollama can run `:cloud` models without `OLLAMA_API_KEY`. `OLLAMA
 
 `--oneshot --json` emits one JSON object per line to stdout (NDJSON), suitable for subprocess consumption. `--approval-mode never` (default) denies approval-required tools and emits a `tool_denied` event; pass `--approval-mode auto` to grant them. Skill crystallization is disabled in one-shot mode. Event types: `session_start`, `thinking`, `content`, `tool_call`, `tool_result`, `tool_denied`, `error`, `done`. The bridge can rely on `session_start` first and `done` last as framing.
 
-Runtime environment values can be stored in `~/.algo_cli/env` — the CLI loads them automatically. Point to a different file with `ALGO_CLI_ENV_FILE`. Legacy `~/.ollama_cli` locations are supported as migration aliases.
+Runtime environment values can be stored in `~/.algo_cli/env` — the CLI loads them automatically. `algo-cli config` shows safe provider status, and `algo-cli config setup PROVIDER` writes only the selected setting with private file permissions. Point to a different file with `ALGO_CLI_ENV_FILE`. Legacy `~/.ollama_cli` locations are supported as migration aliases.
 
-### Optional xAI OAuth setup
+### Provider setup
 
-xAI subscription OAuth is optional and is not configured out of the box. Algo CLI does not bundle or reuse a third-party OAuth client identity. To enable the provider, supply an OAuth client ID that you are authorized to use and configure it for the loopback redirect `http://127.0.0.1:56121/callback`:
+Keep account setup outside the interactive slash palette:
 
 ```bash
-export XAI_CLIENT_ID=your-authorized-client-id
-algo-cli
-# then run /xai-login
+# Safe, redacted readiness summary
+algo-cli config status
+
+# xAI API: prompts for XAI_API_KEY without echoing it
+algo-cli config setup xai
+algo-cli config auth xai verify
+
+# Google Workspace: prompts for a Google Desktop-app OAuth client ID,
+# then opens the PKCE loopback login flow
+algo-cli config setup google
+
+# ChatGPT/Codex browser or device OAuth
+algo-cli config setup chatgpt
 ```
 
-For persistent configuration, place `XAI_CLIENT_ID=your-authorized-client-id` in `~/.algo_cli/env`, or use `ALGO_CLI_ENV_FILE` when you keep runtime settings elsewhere. `/xai-status` and `/doctor` report the provider as optional and unconfigured until `XAI_CLIENT_ID` is present. The client ID value is sent only in the standard OAuth authorization, code-exchange, and refresh requests; status output reports only whether it is configured. Algo CLI never falls back to the removed third-party identity or to `XAI_API_KEY`.
+xAI's public API uses `XAI_API_KEY`; API calls can consume paid usage, so setup never makes a request until you explicitly verify or use a Grok model/tool. Google Workspace uses OAuth 2.0 + PKCE with a local loopback callback. Create a **Desktop app** OAuth client, enable only the Workspace APIs you intend to use, and keep its consent screen/test-user policy aligned with your account. The normal Google operations remain under `/google ...`; only credentials and login moved to `algo-cli config`.
 
 ### Privacy-safe context defaults
 
@@ -162,8 +173,10 @@ Common credential forms are redacted and connector/MCP JSON is metadata-only, bu
 | `/models` | List local models |
 | `/host URL` | Set local Ollama host |
 | `/cloud [on\|off\|status]` | Set/toggle direct Ollama Cloud API mode; local Ollama login can run `:cloud` models with `/cloud off` |
-| `/xai-login` / `/xai-status` | Manage optional xAI Grok OAuth; requires your `XAI_CLIENT_ID`, and API-key fallback is disabled |
-| `/chatgpt-login` / `/chatgpt-status` | Manage ChatGPT/Codex OAuth; `--device-code` uses Codex CLI token import |
+| `/config [status\|setup PROVIDER\|auth PROVIDER ACTION]` | Focused provider setup from the REPL; prefer `algo-cli config ...` in a normal terminal |
+| `algo-cli config setup xai` | Store a redacted xAI API key; API calls may consume paid usage |
+| `algo-cli config setup google` | Configure Google Desktop-app OAuth and launch the PKCE login flow |
+| `algo-cli config setup chatgpt` | Authenticate ChatGPT/Codex outside the normal slash palette |
 | `/x-account status` | Check separate X account OAuth status through `xurl` |
 | `/x-account draft-post` / `draft-reply` | Create browser drafts for X posts/replies without publishing |
 | `/auto [on\|off\|status]` | Set/toggle auto-approve for tool calls |
@@ -261,7 +274,7 @@ The model can call these tools during a conversation:
 
 **Web:** `web_search`, `web_fetch` (requires Ollama Cloud + API key)
 
-**X:** `x_search` uses optional xAI Grok OAuth for read/search and requires your `XAI_CLIENT_ID`. `x_account_status`, `x_account_draft_post`, `x_account_draft_reply`, `x_account_post`, `x_account_reply`, and `x_account_post_action` use the separate X API OAuth lane through `xurl`; write actions require explicit confirmation.
+**X:** `x_search` uses optional xAI API-key access for read/search; configure it with `algo-cli config setup xai`. xAI API calls may consume paid usage. `x_account_status`, `x_account_draft_post`, `x_account_draft_reply`, `x_account_post`, `x_account_reply`, and `x_account_post_action` use the separate X API OAuth lane through `xurl`; write actions require explicit confirmation.
 
 `/x-account` requires the official X API CLI, `xurl`, to be installed and authenticated separately. The CLI only runs `xurl auth status` for status checks and never reads `~/.xurl` directly.
 
@@ -357,7 +370,9 @@ Config is stored in `~/.algo_cli/` by default (data from `~/.ollama_cli` is auto
 | `ALGO_CLI_HARNESS_INDEXER` | Optional Rust harness indexer binary |
 | `OPENAI_OAUTH_CLIENT_ID` | Optional override for the bundled ChatGPT/Codex browser OAuth client |
 | `OPENAI_CODEX_CLIENT_ID` | Optional override for the bundled Codex OAuth client |
-| `XAI_CLIENT_ID` | Your authorized OAuth client ID for optional xAI subscription login; Algo CLI does not bundle one |
+| `XAI_API_KEY` | Optional xAI API key for Grok models and `x_search`; configure with `algo-cli config setup xai` |
+| `GOOGLE_OAUTH_CLIENT_ID` | Google Desktop-app OAuth client ID for Workspace access; configure with `algo-cli config setup google` |
+| `GOOGLE_OAUTH_CLIENT_SECRET` | Optional Google client secret for a client type that requires it; Desktop apps normally omit it |
 | `OLLAMA_HOST` | Local Ollama host |
 | `OLLAMA_API_KEY` | Direct Ollama Cloud API/web tools key; not required for signed-in local `:cloud` models |
 

{algo_cli_runtime-0.16.0 → algo_cli_runtime-0.18.0}/README.md

@@ -52,7 +52,8 @@ algo-cli --model qwen3:235b-cloud
 export OLLAMA_API_KEY="..."
 algo-cli --cloud --model qwen3
 
-# ChatGPT/Codex subscription (authenticate once with /chatgpt-login)
+# ChatGPT/Codex subscription (authenticate once outside the chat REPL)
+algo-cli config setup chatgpt
 algo-cli --model gpt-5.6-sol
 # Short aliases also work: sol, terra, luna
 algo-cli --model terra
@@ -67,19 +68,29 @@ Signed-in local Ollama can run `:cloud` models without `OLLAMA_API_KEY`. `OLLAMA
 
 `--oneshot --json` emits one JSON object per line to stdout (NDJSON), suitable for subprocess consumption. `--approval-mode never` (default) denies approval-required tools and emits a `tool_denied` event; pass `--approval-mode auto` to grant them. Skill crystallization is disabled in one-shot mode. Event types: `session_start`, `thinking`, `content`, `tool_call`, `tool_result`, `tool_denied`, `error`, `done`. The bridge can rely on `session_start` first and `done` last as framing.
 
-Runtime environment values can be stored in `~/.algo_cli/env` — the CLI loads them automatically. Point to a different file with `ALGO_CLI_ENV_FILE`. Legacy `~/.ollama_cli` locations are supported as migration aliases.
+Runtime environment values can be stored in `~/.algo_cli/env` — the CLI loads them automatically. `algo-cli config` shows safe provider status, and `algo-cli config setup PROVIDER` writes only the selected setting with private file permissions. Point to a different file with `ALGO_CLI_ENV_FILE`. Legacy `~/.ollama_cli` locations are supported as migration aliases.
 
-### Optional xAI OAuth setup
+### Provider setup
 
-xAI subscription OAuth is optional and is not configured out of the box. Algo CLI does not bundle or reuse a third-party OAuth client identity. To enable the provider, supply an OAuth client ID that you are authorized to use and configure it for the loopback redirect `http://127.0.0.1:56121/callback`:
+Keep account setup outside the interactive slash palette:
 
 ```bash
-export XAI_CLIENT_ID=your-authorized-client-id
-algo-cli
-# then run /xai-login
+# Safe, redacted readiness summary
+algo-cli config status
+
+# xAI API: prompts for XAI_API_KEY without echoing it
+algo-cli config setup xai
+algo-cli config auth xai verify
+
+# Google Workspace: prompts for a Google Desktop-app OAuth client ID,
+# then opens the PKCE loopback login flow
+algo-cli config setup google
+
+# ChatGPT/Codex browser or device OAuth
+algo-cli config setup chatgpt
 ```
 
-For persistent configuration, place `XAI_CLIENT_ID=your-authorized-client-id` in `~/.algo_cli/env`, or use `ALGO_CLI_ENV_FILE` when you keep runtime settings elsewhere. `/xai-status` and `/doctor` report the provider as optional and unconfigured until `XAI_CLIENT_ID` is present. The client ID value is sent only in the standard OAuth authorization, code-exchange, and refresh requests; status output reports only whether it is configured. Algo CLI never falls back to the removed third-party identity or to `XAI_API_KEY`.
+xAI's public API uses `XAI_API_KEY`; API calls can consume paid usage, so setup never makes a request until you explicitly verify or use a Grok model/tool. Google Workspace uses OAuth 2.0 + PKCE with a local loopback callback. Create a **Desktop app** OAuth client, enable only the Workspace APIs you intend to use, and keep its consent screen/test-user policy aligned with your account. The normal Google operations remain under `/google ...`; only credentials and login moved to `algo-cli config`.
 
 ### Privacy-safe context defaults
 
@@ -104,8 +115,10 @@ Common credential forms are redacted and connector/MCP JSON is metadata-only, bu
 | `/models` | List local models |
 | `/host URL` | Set local Ollama host |
 | `/cloud [on\|off\|status]` | Set/toggle direct Ollama Cloud API mode; local Ollama login can run `:cloud` models with `/cloud off` |
-| `/xai-login` / `/xai-status` | Manage optional xAI Grok OAuth; requires your `XAI_CLIENT_ID`, and API-key fallback is disabled |
-| `/chatgpt-login` / `/chatgpt-status` | Manage ChatGPT/Codex OAuth; `--device-code` uses Codex CLI token import |
+| `/config [status\|setup PROVIDER\|auth PROVIDER ACTION]` | Focused provider setup from the REPL; prefer `algo-cli config ...` in a normal terminal |
+| `algo-cli config setup xai` | Store a redacted xAI API key; API calls may consume paid usage |
+| `algo-cli config setup google` | Configure Google Desktop-app OAuth and launch the PKCE login flow |
+| `algo-cli config setup chatgpt` | Authenticate ChatGPT/Codex outside the normal slash palette |
 | `/x-account status` | Check separate X account OAuth status through `xurl` |
 | `/x-account draft-post` / `draft-reply` | Create browser drafts for X posts/replies without publishing |
 | `/auto [on\|off\|status]` | Set/toggle auto-approve for tool calls |
@@ -203,7 +216,7 @@ The model can call these tools during a conversation:
 
 **Web:** `web_search`, `web_fetch` (requires Ollama Cloud + API key)
 
-**X:** `x_search` uses optional xAI Grok OAuth for read/search and requires your `XAI_CLIENT_ID`. `x_account_status`, `x_account_draft_post`, `x_account_draft_reply`, `x_account_post`, `x_account_reply`, and `x_account_post_action` use the separate X API OAuth lane through `xurl`; write actions require explicit confirmation.
+**X:** `x_search` uses optional xAI API-key access for read/search; configure it with `algo-cli config setup xai`. xAI API calls may consume paid usage. `x_account_status`, `x_account_draft_post`, `x_account_draft_reply`, `x_account_post`, `x_account_reply`, and `x_account_post_action` use the separate X API OAuth lane through `xurl`; write actions require explicit confirmation.
 
 `/x-account` requires the official X API CLI, `xurl`, to be installed and authenticated separately. The CLI only runs `xurl auth status` for status checks and never reads `~/.xurl` directly.
 
@@ -299,7 +312,9 @@ Config is stored in `~/.algo_cli/` by default (data from `~/.ollama_cli` is auto
 | `ALGO_CLI_HARNESS_INDEXER` | Optional Rust harness indexer binary |
 | `OPENAI_OAUTH_CLIENT_ID` | Optional override for the bundled ChatGPT/Codex browser OAuth client |
 | `OPENAI_CODEX_CLIENT_ID` | Optional override for the bundled Codex OAuth client |
-| `XAI_CLIENT_ID` | Your authorized OAuth client ID for optional xAI subscription login; Algo CLI does not bundle one |
+| `XAI_API_KEY` | Optional xAI API key for Grok models and `x_search`; configure with `algo-cli config setup xai` |
+| `GOOGLE_OAUTH_CLIENT_ID` | Google Desktop-app OAuth client ID for Workspace access; configure with `algo-cli config setup google` |
+| `GOOGLE_OAUTH_CLIENT_SECRET` | Optional Google client secret for a client type that requires it; Desktop apps normally omit it |
 | `OLLAMA_HOST` | Local Ollama host |
 | `OLLAMA_API_KEY` | Direct Ollama Cloud API/web tools key; not required for signed-in local `:cloud` models |
 

{algo_cli_runtime-0.16.0 → algo_cli_runtime-0.18.0}/algo_cli/__init__.py

@@ -1,3 +1,3 @@
 """Algo CLI agent runtime."""
 
-__version__ = "0.16.0"
+__version__ = "0.18.0"

{algo_cli_runtime-0.16.0 → algo_cli_runtime-0.18.0}/algo_cli/action_registry.py

@@ -516,7 +516,7 @@ ACTION_SPECS: tuple[ActionSpec, ...] = (
         "google_workspace.read", "provider", "Google Workspace access (read/write Drive/Docs/Sheets/Calendar plus Gmail read/draft creation) via OAuth.",
         "provider",
         ("google-workspace", "oauth", "read-write", "network"),
-        "Provides Google Workspace access behind the /google-login OAuth flow; Gmail writes are limited to draft creation for user review.",
+        "Provides Google Workspace access behind the `algo-cli config setup google` OAuth flow; Gmail writes are limited to draft creation for user review.",
         "medium", False, False, True,
         requires_network=True,
         requires_provider="google-workspace",
@@ -530,19 +530,35 @@ ACTION_SPECS: tuple[ActionSpec, ...] = (
         "/google-login", "slash", "Authenticate with Google Workspace (OAuth2 + PKCE).",
         "provider",
         ("google-workspace", "oauth", "auth"),
-        "Detects missing GOOGLE_OAUTH_CLIENT_ID before starting the loopback flow.", "medium", True, True, True,
+        "Compatibility route for existing sessions; new setup lives under `algo-cli config`.", "medium", True, True, True,
+        archived=True,
+        archived_reason="Provider setup moved out of the normal slash palette.",
+        replacement="Use `algo-cli config auth google login`.",
     ),
     _spec(
         "/google-logout", "slash", "Revoke Google Workspace tokens locally.",
         "provider",
         ("google-workspace", "auth", "logout"),
-        "Clears local Google Workspace tokens and best-effort revokes at Google.", "medium", True, True, True,
+        "Compatibility route for existing sessions; new setup lives under `algo-cli config`.", "medium", True, True, True,
+        archived=True,
+        archived_reason="Provider setup moved out of the normal slash palette.",
+        replacement="Use `algo-cli config auth google logout`.",
     ),
     _spec(
         "/google-status", "slash", "Show Google Workspace auth state.",
         "provider",
         ("google-workspace", "auth", "status"),
-        "Surfaces whether the user is authenticated and which scopes were granted.", "low", False, False, True,
+        "Compatibility route for existing sessions; new setup lives under `algo-cli config`.", "low", False, False, True,
+        archived=True,
+        archived_reason="Provider setup moved out of the normal slash palette.",
+        replacement="Use `algo-cli config auth google status`.",
+    ),
+    _spec(
+        "/config", "slash", "Configure or inspect connected providers outside the normal slash palette.",
+        "provider",
+        ("provider", "configuration", "credentials", "oauth"),
+        "`/config status` is read-only; setup and login paths can write local credential state or open a browser.",
+        "medium", True, True, False,
     ),
     _spec(
         "/google", "slash", "Run Google Workspace commands (Drive/Docs/Sheets/Calendar read/write plus Gmail read/drafts).",
@@ -981,39 +997,39 @@ def build_doctor_report(cfg: Any) -> DoctorReport:
             "Set ALGO_CLI_ENV_FILE or ~/.algo_cli/env with OLLAMA_API_KEY, then rerun /doctor.",
         ))
 
-    # xAI subscription OAuth is an optional provider and deliberately ships
-    # without a third-party OAuth client identity. Its absence must not make a
-    # fresh local install look unhealthy.
+    # xAI API access is optional.  A missing key must not make a fresh local
+    # install look unhealthy, but the readiness report must not claim that an
+    # undocumented consumer OAuth lane is usable.
     try:
         from . import xai_auth
 
         xai_status = xai_auth.auth_status()
-        if not xai_status.get("client_configured"):
+        if not xai_status.get("api_key_configured"):
             findings.append(DoctorFinding(
                 "ready",
-                "xai-oauth",
-                "optional xAI subscription OAuth is not configured (no bundled client id)",
-                "Set XAI_CLIENT_ID in ~/.algo_cli/env only if you want to enable this provider.",
+                "xai-api",
+                "optional xAI API key is not configured",
+                "Run `algo-cli config setup xai` only if you want to enable Grok API models or x_search.",
             ))
-        elif xai_status.get("authenticated"):
+        else:
             findings.append(DoctorFinding(
                 "ready",
-                "xai-oauth",
-                f"optional xAI OAuth authenticated (expires in {int(xai_status.get('expires_in', 0))}s)",
+                "xai-api",
+                "optional xAI API key configured (value redacted)",
             ))
-        else:
+        if xai_status.get("legacy_oauth_detected"):
             findings.append(DoctorFinding(
-                "ready",
-                "xai-oauth",
-                "optional xAI OAuth client configured; no active session",
-                "Run /xai-login if you want to use xAI models.",
+                "degraded",
+                "xai-legacy-oauth",
+                "obsolete xAI OAuth state detected and ignored",
+                "Remove it with `algo-cli config auth xai logout` or reconfigure with `algo-cli config setup xai`.",
             ))
     except Exception as exc:  # pragma: no cover - best-effort diagnostic
         findings.append(DoctorFinding(
             "degraded",
-            "xai-oauth",
+            "xai-api",
             f"xai_auth import failed: {exc}",
-            "Reinstall Algo CLI; the module is required for optional /xai-* commands.",
+            "Reinstall Algo CLI; the module is required for optional xAI API commands.",
         ))
 
     from . import index_compute_lab
@@ -1069,7 +1085,7 @@ def build_doctor_report(cfg: Any) -> DoctorReport:
             findings.append(DoctorFinding(
                 "degraded", "google-workspace",
                 "GOOGLE_OAUTH_CLIENT_ID not set",
-                "Create an OAuth client at https://console.cloud.google.com and export the id before /google-login.",
+                "Create a Desktop app OAuth client, then run `algo-cli config setup google` before logging in.",
             ))
         elif status.get("authenticated"):
             findings.append(DoctorFinding(
@@ -1080,7 +1096,7 @@ def build_doctor_report(cfg: Any) -> DoctorReport:
             findings.append(DoctorFinding(
                 "degraded", "google-workspace",
                 "Google OAuth client configured but no active session",
-                "Run /google-login to start the loopback flow.",
+                "Run `algo-cli config auth google login` to start the loopback flow.",
             ))
     except Exception as exc:  # pragma: no cover - best-effort diagnostic
         findings.append(DoctorFinding(