@ouro.bot/cli 0.1.0-alpha.637 → 0.1.0-alpha.639

package/dist/heart/core.js

@@ -344,6 +344,22 @@ function privateReturnAckLeakError(answer, heldTokens) {
     }
     return null;
 }
+function claimsPrivateReturnQueued(answer) {
+    if (!answer)
+        return false;
+    const normalized = answer.toLowerCase();
+    return /\b(queued|queue|will return|return when|when .*complete|when .*completes|private pass|inner dialog completes|later)\b/.test(normalized)
+        && /\b(private|inner|return|queued|later)\b/.test(normalized);
+}
+function privateReturnMissingPonderError(input) {
+    if (input.sawPonder)
+        return null;
+    if (!looksLikePrivateReturnRequest(input.latestUserRequest))
+        return null;
+    if (!claimsPrivateReturnQueued(input.answer))
+        return null;
+    return "private-return acknowledgement claimed work was queued, but no ponder packet was created this turn. Call ponder(action=create, ...) first so the return has a packet, return obligation, and inner wake; then settle with only a queued acknowledgement. If you cannot create the packet, ask a blocking clarification without saying it is queued.";
+}
 function activeReturnObligationId(agentName, obligationId) {
     if (!obligationId)
         return null;
@@ -996,6 +1012,11 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                     }
                     const deliveredAnswer = answer;
                     const retryError = privateReturnAckLeakError(deliveredAnswer, privateReturnHeldTokens)
+                        ?? privateReturnMissingPonderError({
+                            latestUserRequest: latestUserMessageText(messages),
+                            answer: deliveredAnswer,
+                            sawPonder,
+                        })
                         ?? getSettleRetryError(mustResolveBeforeHandoffActive, intent, sawSteeringFollowUp, options?.delegationDecision, sawSendMessageSelf, sawPonder, sawQuerySession, options?.currentObligation ?? null, options?.activeWorkFrame?.inner?.job, sawExternalStateQuery);
                     const validDirectReply = mustResolveBeforeHandoffActive && intent === "direct_reply" && sawSteeringFollowUp;
                     const validTerminalIntent = intent === "complete" || intent === "blocked";

package/dist/heart/daemon/cli-defaults.js

@@ -719,6 +719,7 @@ function createDefaultOuroCliDeps(socketPath = socket_client_1.DEFAULT_DAEMON_SO
             });
         },
         installCliVersion: async (version) => { (0, ouro_version_manager_1.installVersion)(version, {}); },
+        validateCliVersionForActivation: (version) => (0, ouro_version_manager_1.validateInstalledVersionForActivation)(version, {}),
         activateCliVersion: (version) => {
             (0, ouro_version_manager_1.activateVersion)(version, {});
             // Same self-prune as ensureCurrentVersionInstalled — fires from the

package/dist/heart/daemon/cli-exec.js

@@ -6112,6 +6112,11 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                     return message;
                 }
             }
+            const validation = deps.validateCliVersionForActivation?.(command.version);
+            if (validation && !validation.ok) {
+                const message = `refusing to roll back to ${command.version}: ${validation.message}`;
+                return returnCliFailure(deps, message);
+            }
             deps.activateCliVersion(command.version);
         }
         else {
@@ -6122,6 +6127,11 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                 deps.writeStdout(message);
                 return message;
             }
+            const validation = deps.validateCliVersionForActivation?.(previousVersion);
+            if (validation && !validation.ok) {
+                const message = `refusing to roll back to ${previousVersion}: ${validation.message}`;
+                return returnCliFailure(deps, message);
+            }
             deps.activateCliVersion(previousVersion);
             command = { ...command, version: previousVersion };
         }

package/dist/heart/versioning/ouro-version-manager.js

@@ -39,6 +39,7 @@ exports.getCurrentVersion = getCurrentVersion;
 exports.getPreviousVersion = getPreviousVersion;
 exports.buildChangelogCommand = buildChangelogCommand;
 exports.listInstalledVersions = listInstalledVersions;
+exports.validateInstalledVersionForActivation = validateInstalledVersionForActivation;
 exports.installVersion = installVersion;
 exports.activateVersion = activateVersion;
 exports.compareCliVersions = compareCliVersions;
@@ -51,6 +52,31 @@ const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
 /** Maximum number of installed CLI versions to retain after pruning. */
 exports.DEFAULT_RETAIN_VERSIONS = 5;
+const INSTALLED_RUNTIME_PACKAGE_PAYLOAD_PATHS = [
+    "assets",
+    "dist",
+    "RepairGuide.ouro",
+    "SerpentGuide.ouro",
+    "skills",
+    "changelog.json",
+    "package.json",
+];
+const INSTALLED_RUNTIME_TEXT_EXTENSIONS = new Set([
+    ".cjs",
+    ".css",
+    ".html",
+    ".js",
+    ".json",
+    ".md",
+    ".mjs",
+    ".txt",
+]);
+const BLOCKED_INSTALLED_RUNTIME_TEXT_SIGNATURES = [
+    {
+        label: "removed BlueBubbles timeout notice",
+        base64: "bGl2ZSBpTWVzc2FnZSB0dXJuIHRpbWVkIG91dDsgSSBjYXB0dXJlZCBpdCBmb3IgcmVjb3ZlcnkgaW5zdGVhZCBvZiBzaWxlbnRseSBoYW5naW5n",
+    },
+];
 function getOuroCliHome(homeDir) {
     /* v8 ignore next -- dep default: tests always inject @preserve */
     const home = homeDir ?? os.homedir();
@@ -98,6 +124,94 @@ function listInstalledVersions(deps) {
         return [];
     }
 }
+function validateInstalledVersionForActivation(version, deps = {}) {
+    const cliHome = getOuroCliHome(deps.homeDir);
+    /* v8 ignore start -- dep defaults: tests inject @preserve */
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    const readdirSync = deps.readdirSync ?? ((p, opts) => fs.readdirSync(p, opts));
+    const readFileSync = deps.readFileSync ?? fs.readFileSync;
+    /* v8 ignore stop */
+    const packageRoot = path.join(cliHome, "versions", version, "node_modules", "@ouro.bot", "cli");
+    const packageJsonPath = path.join(packageRoot, "package.json");
+    if (!existsSync(packageJsonPath)) {
+        const message = `installed runtime ${version} is missing its @ouro.bot/cli package; run 'ouro up' to restore the current release`;
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.cli_version_activation_blocked",
+            message: "blocked CLI version activation",
+            meta: { version, packageRoot, reason: "missing-package" },
+            level: "warn",
+        });
+        return { ok: false, version, packageRoot, violations: ["missing @ouro.bot/cli package"], message };
+    }
+    const violations = findBlockedInstalledRuntimePayloadText(packageRoot, { existsSync, readdirSync, readFileSync });
+    if (violations.length === 0) {
+        return { ok: true, version, packageRoot, violations, message: "installed runtime package passed activation guard" };
+    }
+    const message = `installed runtime ${version} contains blocked package assets (${violations.join(", ")}); run 'ouro up' to stay on the current release`;
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.cli_version_activation_blocked",
+        message: "blocked CLI version activation",
+        meta: { version, packageRoot, reason: "blocked-package-assets", violations },
+        level: "warn",
+    });
+    return { ok: false, version, packageRoot, violations, message };
+}
+function findBlockedInstalledRuntimePayloadText(packageRoot, deps) {
+    const violations = [];
+    const blockedText = BLOCKED_INSTALLED_RUNTIME_TEXT_SIGNATURES.map((signature) => ({
+        label: signature.label,
+        text: Buffer.from(signature.base64, "base64").toString("utf8"),
+    }));
+    for (const payloadPath of INSTALLED_RUNTIME_PACKAGE_PAYLOAD_PATHS) {
+        const absolutePath = path.join(packageRoot, payloadPath);
+        if (!deps.existsSync(absolutePath))
+            continue;
+        collectBlockedTextViolations(packageRoot, absolutePath, payloadPath, blockedText, deps, violations);
+    }
+    return violations.sort();
+}
+function collectBlockedTextViolations(packageRoot, absolutePath, relativePath, blockedText, deps, violations) {
+    let entries = null;
+    try {
+        entries = deps.readdirSync(absolutePath, { withFileTypes: true });
+    }
+    catch {
+        entries = null;
+    }
+    if (entries !== null) {
+        for (const entry of entries) {
+            const childRelativePath = `${relativePath}/${entry.name}`;
+            if (entry.isDirectory()) {
+                collectBlockedTextViolations(packageRoot, path.join(absolutePath, entry.name), childRelativePath, blockedText, deps, violations);
+            }
+            else if (entry.isFile()) {
+                inspectInstalledRuntimePayloadFile(packageRoot, childRelativePath, blockedText, deps, violations);
+            }
+        }
+        return;
+    }
+    inspectInstalledRuntimePayloadFile(packageRoot, relativePath, blockedText, deps, violations);
+}
+function inspectInstalledRuntimePayloadFile(packageRoot, relativePath, blockedText, deps, violations) {
+    if (!INSTALLED_RUNTIME_TEXT_EXTENSIONS.has(path.extname(relativePath)))
+        return;
+    let content = "";
+    try {
+        content = deps.readFileSync(path.join(packageRoot, relativePath), "utf8");
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error);
+        violations.push(`${relativePath} could not be inspected: ${reason}`);
+        return;
+    }
+    for (const blocked of blockedText) {
+        if (content.includes(blocked.text)) {
+            violations.push(`${relativePath} contains ${blocked.label}`);
+        }
+    }
+}
 function installVersion(version, deps) {
     const cliHome = getOuroCliHome(deps.homeDir);
     /* v8 ignore start -- dep defaults: tests always inject @preserve */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.637",
+  "version": "0.1.0-alpha.639",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",