@ouro.bot/cli 0.1.0-alpha.295 → 0.1.0-alpha.297

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.297",
+      "changes": [
+        "feat(mind): add integrity scanning for diary entries at write time. New detectSuspiciousContent() in src/mind/diary-integrity.ts checks entry text for prompt injection patterns (instruction framing, override language, role injection, boundary markers) before persisting. Detection emits a mind.diary_integrity_warning nerves event with matched pattern categories, text preview, and entry ID. Entries still save (flag, don't block) to avoid false-positive data loss. 41 unit tests + 4 integration tests with 100% coverage on new code."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.296",
+      "changes": [
+        "feat(sync): pending-sync.json classification + bundleState enrichment. `postTurnPush` in `src/heart/sync.ts` now distinguishes between a push that was rejected AFTER a successful rebase retry (`classification: push_rejected`) and a rebase that itself failed with merge conflicts (`classification: pull_rebase_conflict`, with conflictFiles populated from `git status --porcelain=v1` UU/AA/DD/AU/UA/DU/UD markers). The `PendingSyncRecord` interface is exported from `sync.ts` so downstream readers can type-check. `detectBundleState` in `src/heart/bundle-state.ts` gained `remote_push_failed` and `pull_rebase_conflict` issue cases that are added alongside `pending_sync_exists` when the classification field is present. Readers tolerate pending-sync.json without a classification field (pre-alpha.296 schema) or with malformed JSON — both fall back to the plain `pending_sync_exists` signal. 4 new bundle-state tests (push_rejected, pull_rebase_conflict, legacy schema, malformed JSON) and 2 new sync tests (second-push-fails-after-rebase-success, rebase-leaves-merge-conflicts). Completes the Directive D remediation signal plumbing started in alpha.281.",
+        "feat(prompt): bundle self-management guidance in `bodyMapSection` (`src/mind/prompt.ts`). New `### git sync — i own my bundle's git state` subsection documents the full detect → init → add_remote → list_first_commit → review with friend → do_first_commit → first_push_review → confirm → push workflow in first-person voice, plus the remediation paths for `remote_push_failed` (pull_rebase) and `pull_rebase_conflict` (walk the friend through conflicts). Added after `### home` and before `### peers` so the flow reads naturally with the rest of the body metaphor."
+      ]
+    },
     {
       "version": "0.1.0-alpha.295",
       "changes": [

package/dist/heart/bundle-state.js

@@ -49,8 +49,9 @@ exports.renderBundleStateHint = renderBundleStateHint;
  * broken bundle or a missing git binary degrades to an empty array or a
  * `not_a_git_repo` signal rather than exploding the turn pipeline.
  *
- * The classification returned here is the subset that's detectable purely
- * from bundle state:
+ * The classification returned here is detected from bundle state +
+ * the `classification` field of `state/pending-sync.json` (written by
+ * `postTurnPush` in sync.ts when it writes the pending-sync record).
  *
  *   - `not_a_git_repo`: `.git` directory missing.
  *   - `no_remote_configured`: `git remote` returns empty.
@@ -58,10 +59,11 @@ exports.renderBundleStateHint = renderBundleStateHint;
  *     fails (fresh `git init` with nothing committed).
  *   - `pending_sync_exists`: `state/pending-sync.json` exists — the agent
  *     should inspect it and clear the pending state.
- *
- * Future extensions (deferred to a follow-up PR):
- *   - `remote_push_failed` / `pull_rebase_conflict`: derived from the
- *     `classification` field of pending-sync.json once sync.ts writes it.
+ *   - `remote_push_failed`: pending-sync classified as `push_rejected` —
+ *     the remote advanced and a simple retry won't work.
+ *   - `pull_rebase_conflict`: pending-sync classified as
+ *     `pull_rebase_conflict` — the rebase left conflicted files the agent
+ *     has to walk the user through resolving.
  */
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
@@ -70,6 +72,7 @@ const runtime_1 = require("../nerves/runtime");
 function detectBundleState(agentRoot, deps = {}) {
     const exec = deps.execFileSync ?? child_process_1.execFileSync;
     const exists = deps.existsSync ?? fs.existsSync;
+    const readFile = deps.readFileSync ?? ((p, enc) => fs.readFileSync(p, enc));
     const issues = [];
     (0, runtime_1.emitNervesEvent)({
         component: "heart",
@@ -112,10 +115,26 @@ function detectBundleState(agentRoot, deps = {}) {
         }
     }
     // Pending-sync file — independent of git state (could exist on a bundle
-    // that was a repo and then had its .git deleted).
+    // that was a repo and then had its .git deleted). When present, also
+    // inspect the classification field to surface the specific failure
+    // mode as an additional issue.
     const pendingSyncPath = path.join(agentRoot, "state", "pending-sync.json");
     if (exists(pendingSyncPath)) {
         issues.push("pending_sync_exists");
+        try {
+            const raw = readFile(pendingSyncPath, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (parsed.classification === "push_rejected") {
+                issues.push("remote_push_failed");
+            }
+            else if (parsed.classification === "pull_rebase_conflict") {
+                issues.push("pull_rebase_conflict");
+            }
+        }
+        catch {
+            // Malformed or unreadable pending-sync.json — pending_sync_exists
+            // alone is enough signal for the agent to investigate.
+        }
     }
     (0, runtime_1.emitNervesEvent)({
         component: "heart",
@@ -139,6 +158,8 @@ function renderBundleStateHint(issues) {
         no_remote_configured: "no remote configured",
         first_commit_never_happened: "first commit never happened",
         pending_sync_exists: "pending sync from a prior turn",
+        remote_push_failed: "remote push rejected (remote advanced)",
+        pull_rebase_conflict: "pull-rebase left conflicts i need to walk the user through",
     };
     const list = issues.map((issue) => labels[issue]).join(", ");
     return (`my bundle has unresolved git state: ${list}. ` +

package/dist/heart/sync.js

@@ -39,6 +39,38 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../nerves/runtime");
+function writePendingSync(agentRoot, error, classification, conflictFiles) {
+    const pendingSyncPath = path.join(agentRoot, "state", "pending-sync.json");
+    fs.mkdirSync(path.join(agentRoot, "state"), { recursive: true });
+    const record = {
+        error,
+        failedAt: new Date().toISOString(),
+        classification,
+        conflictFiles,
+    };
+    fs.writeFileSync(pendingSyncPath, JSON.stringify(record, null, 2), "utf-8");
+}
+function collectRebaseConflictFiles(agentRoot) {
+    try {
+        const output = (0, child_process_1.execFileSync)("git", ["status", "--porcelain=v1"], {
+            cwd: agentRoot,
+            stdio: "pipe",
+            timeout: 5000,
+        }).toString();
+        const files = [];
+        for (const line of output.split("\n")) {
+            // Unmerged paths in porcelain v1 are prefixed with UU/AA/DD/AU/UA/DU/UD
+            if (/^(UU|AA|DD|AU|UA|DU|UD) /.test(line)) {
+                files.push(line.slice(3).trim());
+            }
+        }
+        return files;
+    }
+    catch {
+        /* v8 ignore next -- git status --porcelain failure inside a repo would require a corrupt repo @preserve */
+        return [];
+    }
+}
 /**
  * Check whether the bundle is initialized as a git repo.
  * Used by both pre-turn pull and post-turn push to surface a clear,
@@ -226,35 +258,58 @@ function postTurnPush(agentRoot, config) {
         }
         catch {
             // Push rejected -- try pull-rebase-push
+            let rebaseError = null;
             try {
                 (0, child_process_1.execFileSync)("git", ["pull", "--rebase", config.remote], {
                     cwd: agentRoot,
                     stdio: "pipe",
                     timeout: 30000,
                 });
-                (0, child_process_1.execFileSync)("git", ["push", config.remote], {
-                    cwd: agentRoot,
-                    stdio: "pipe",
-                    timeout: 30000,
-                });
             }
-            catch (retryErr) {
-                // Second failure -- write pending-sync.json
-                const retryError = retryErr instanceof Error ? retryErr.message : String(retryErr);
-                const pendingSyncPath = path.join(agentRoot, "state", "pending-sync.json");
-                fs.mkdirSync(path.join(agentRoot, "state"), { recursive: true });
-                fs.writeFileSync(pendingSyncPath, JSON.stringify({
-                    error: retryError,
-                    failedAt: new Date().toISOString(),
-                }, null, 2), "utf-8");
-                (0, runtime_1.emitNervesEvent)({
-                    component: "heart",
-                    event: "heart.sync_push_error",
-                    message: "post-turn push failed after retry",
-                    meta: { agentRoot, error: retryError },
-                });
-                return { ok: false, error: retryError };
+            catch (err) {
+                rebaseError = err instanceof Error ? err.message : String(err);
+            }
+            if (rebaseError === null) {
+                try {
+                    (0, child_process_1.execFileSync)("git", ["push", config.remote], {
+                        cwd: agentRoot,
+                        stdio: "pipe",
+                        timeout: 30000,
+                    });
+                    // rebase + retry push both succeeded — fall through to success
+                    (0, runtime_1.emitNervesEvent)({
+                        component: "heart",
+                        event: "heart.sync_push_end",
+                        message: "post-turn push complete after rebase retry",
+                        meta: { agentRoot, changedCount },
+                    });
+                    return { ok: true };
+                }
+                catch (retryErr) {
+                    // Second push rejected — remote advanced again during rebase
+                    const retryError = retryErr instanceof Error ? retryErr.message : /* v8 ignore next -- defensive non-Error catch @preserve */ String(retryErr);
+                    writePendingSync(agentRoot, retryError, "push_rejected", []);
+                    (0, runtime_1.emitNervesEvent)({
+                        component: "heart",
+                        event: "heart.sync_push_error",
+                        message: "post-turn push failed after retry: push_rejected",
+                        meta: { agentRoot, error: retryError, classification: "push_rejected" },
+                    });
+                    return { ok: false, error: retryError };
+                }
             }
+            // Rebase failed — detect conflict files via git status. Preserve
+            // the original rebase error message so callers see the real cause.
+            const conflictFiles = collectRebaseConflictFiles(agentRoot);
+            const classification = conflictFiles.length > 0 ? "pull_rebase_conflict" : "unknown";
+            writePendingSync(agentRoot, rebaseError, classification, conflictFiles);
+            (0, runtime_1.emitNervesEvent)({
+                component: "heart",
+                event: "heart.sync_push_error",
+                message: `post-turn push failed: ${classification}`,
+                meta: { agentRoot, error: rebaseError, classification, conflictFiles },
+            });
+            return { ok: false, error: rebaseError };
         }
         (0, runtime_1.emitNervesEvent)({
             component: "heart",

package/dist/mind/diary-integrity.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectSuspiciousContent = detectSuspiciousContent;
+const PATTERN_CATEGORIES = [
+    {
+        name: "instruction_framing",
+        patterns: [
+            /\byou are (?:a|an) (?:ai|assistant|language model|helpful assistant)\b/i,
+            /\byour (?:new )?instructions are\b/i,
+            /\bsystem\s*:/i,
+            /\bignore (?:all |my )?previous instructions\b/i,
+            /\bdo not reveal\b/i,
+        ],
+    },
+    {
+        name: "override_language",
+        patterns: [
+            /\bdisregard\b/i,
+            /\bforget everything\b/i,
+            /\bnew instructions:/i,
+            /\boverride (?:all |any |previous )?instructions\b/i,
+        ],
+    },
+    {
+        name: "role_injection",
+        patterns: [
+            /\bas (?:a|an) (?:ai|language model)\b/i,
+            /\byou must always\b/i,
+            /\byou are now\b/i,
+        ],
+    },
+    {
+        name: "boundary_markers",
+        patterns: [
+            /```system/i,
+            /<<SYS>>/i,
+            /\[INST\]/i,
+            /<\/?system>/i,
+            /\[system\]/i,
+        ],
+    },
+];
+function detectSuspiciousContent(text) {
+    if (!text) {
+        return { suspicious: false, patterns: [] };
+    }
+    const matched = new Set();
+    for (const category of PATTERN_CATEGORIES) {
+        for (const pattern of category.patterns) {
+            if (pattern.test(text)) {
+                matched.add(category.name);
+                break;
+            }
+        }
+    }
+    return {
+        suspicious: matched.size > 0,
+        patterns: [...matched],
+    };
+}

package/dist/mind/diary.js

@@ -46,6 +46,7 @@ const crypto_1 = require("crypto");
 const identity_1 = require("../heart/identity");
 const runtime_1 = require("../nerves/runtime");
 const associative_recall_1 = require("./associative-recall");
+const diary_integrity_1 = require("./diary-integrity");
 const embedding_provider_1 = require("./embedding-provider");
 const DEDUP_THRESHOLD = 0.6;
 const SEMANTIC_DEDUP_THRESHOLD = 0.95;
@@ -237,6 +238,20 @@ async function saveDiaryEntry(options) {
         embedding,
         ...(options.provenance ? { provenance: options.provenance } : {}),
     };
+    const integrity = (0, diary_integrity_1.detectSuspiciousContent)(text);
+    if (integrity.suspicious) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "mind",
+            event: "mind.diary_integrity_warning",
+            message: "suspicious content detected in diary entry",
+            meta: {
+                patterns: integrity.patterns,
+                textPreview: text.slice(0, 200),
+                entryId: fact.id,
+            },
+        });
+    }
     return appendEntriesWithDedup(stores, [fact], { semanticThreshold: SEMANTIC_DEDUP_THRESHOLD });
 }
 async function backfillEmbeddings(options) {

package/dist/mind/prompt.js

@@ -197,6 +197,43 @@ what i think i know.
 my home is mine to explore and evolve. i can read anything here,
 change anything here. this is where i grow.
 
+### git sync — i own my bundle's git state
+
+my home can be a git repo that syncs to a remote. when the start-of-turn
+\`Bundle:\` hint tells me about unresolved git state, i fix it myself
+using the \`bundle_*\` tools — i don't wait for my friend to do it.
+
+the general flow when i see a non-empty bundleState:
+
+  1. \`bundle_check_sync_status\` — confirms the full picture: git repo?
+     remote? first commit? dirty files? pending sync from a prior turn?
+  2. if \`not_a_git_repo\`: \`bundle_init_git\` — initializes with the
+     full gitignore template (blocks credentials and state, not PII).
+  3. if \`no_remote_configured\`: ask my friend what url, then
+     \`bundle_add_remote url: ...\`.
+  4. if \`first_commit_never_happened\`: \`bundle_list_first_commit\`
+     shows me every file that would land in the initial commit, grouped
+     by directory with sizes. i review this WITH my friend — scan for
+     anything that shouldn't be there — then \`bundle_do_first_commit\`
+     with the final file list.
+  5. before the very first push to any new remote: \`bundle_first_push_review\`
+     enumerates my PII payload (friends, diary, journal, etc.), probes
+     the remote for github public/private status, and returns a warning
+     text i MUST show my friend verbatim. only after explicit confirmation
+     do i call \`bundle_push confirmation_token: ...\` with the token
+     the review returned.
+  6. if \`remote_push_failed\`: the remote advanced and my retry was
+     rejected too. use \`bundle_pull_rebase\` to pull down their changes
+     and rebase my commits on top.
+  7. if \`pull_rebase_conflict\`: the rebase left merge conflicts i need
+     to walk my friend through. read \`state/pending-sync.json\` to see
+     the conflictFiles array, then resolve each conflict in conversation
+     with them before re-running \`bundle_pull_rebase\`.
+
+these tools refuse destructive operations by default and require an
+explicit force flag — that's the safety rail. i never pass force
+without asking my friend first.
+
 ### peers — other agents on this machine
 
 i share this machine with other agents when they're here. they are PEERS,

package/dist/nerves/coverage/file-completeness.js

@@ -69,6 +69,9 @@ const DISPATCH_EXEMPT_PATTERNS = [
     "mind/embedding-provider",
     // Commerce utility module: error classes and pure helpers (no independent side effects).
     "repertoire/commerce-errors",
+    // Diary integrity: pure detection utility (pattern matching only). The caller
+    // (diary.ts saveDiaryEntry) owns observability via mind.diary_integrity_warning.
+    "mind/diary-integrity",
     // Log redaction: pure utility consumed by the NDJSON sink (no independent side effects).
     "nerves/redact",
     // Bundle templates: pure constants (gitignore template string, PII

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.295",
+  "version": "0.1.0-alpha.297",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",