@ouro.bot/cli 0.1.0-alpha.641 → 0.1.0-alpha.643

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.643",
+      "changes": [
+        "Dependency audit hardening: refresh the Teams SDK family and vulnerable transitive packages, force Teams' stale msal-node edge onto the safe 5.2.x line, update Teams invoke handlers for the newer SDK route-handler return contract, and add a root npm audit gate to release preflight."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.642",
+      "changes": [
+        "Make private-return packet trace source requests runtime-authoritative: outward ponder packet payloads now always record the latest originating user request as sourceRequest, even if the model supplies a lossy sourceRequest in payload_json; tool guidance now tells the model to preserve literal markers and constraints separately while the runtime owns sourceRequest."
+      ]
+    },
     {
       "version": "0.1.0-alpha.641",
       "changes": [

package/dist/heart/core.js

@@ -1329,7 +1329,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                                 if (!kind || !objective || !successCriteria || !payload) {
                                     throw new Error("ponder create requires kind, objective, success_criteria, and valid payload_json.");
                                 }
-                                const packetPayload = sourceRequest && typeof payload.sourceRequest !== "string"
+                                const packetPayload = sourceRequest
                                     ? { ...payload, sourceRequest }
                                     : payload;
                                 const createLinkedReturnObligation = (id, packetId) => {

package/dist/repertoire/tools-flow.js

@@ -5,7 +5,7 @@ exports.ponderTool = {
     type: "function",
     function: {
         name: "ponder",
-        description: "create or revise a typed ponder packet so i don't lose the plot while i keep working. use this for harness friction, research, or reflection that should survive the current turn. if the user asked me to think privately and return later from an outward session, preserve literal return tokens and constraints in payload_json/sourceRequest or success_criteria, then do not settle with the final private answer in the same outward turn; only acknowledge that the private pass is queued. in inner dialog, ponder only preserves state; it does not create a new self-return obligation, so surface any existing held item instead of pondering a replacement. ponder does not end the turn by itself and may be followed by more tools before i settle or rest. Don't ponder trivial questions.",
+        description: "create or revise a typed ponder packet so i don't lose the plot while i keep working. use this for harness friction, research, or reflection that should survive the current turn. if the user asked me to think privately and return later from an outward session, preserve literal return tokens and constraints in payload_json fields or success_criteria; the runtime records the latest user request as sourceRequest. then do not settle with the final private answer in the same outward turn; only acknowledge that the private pass is queued. in inner dialog, ponder only preserves state; it does not create a new self-return obligation, so surface any existing held item instead of pondering a replacement. ponder does not end the turn by itself and may be followed by more tools before i settle or rest. Don't ponder trivial questions.",
         parameters: {
             type: "object",
             properties: {
@@ -41,7 +41,7 @@ exports.ponderTool = {
                 },
                 payload_json: {
                     type: "string",
-                    description: "JSON object string with packet-specific structured details. include sourceRequest when the user gave exact return wording, markers, or constraints the inner pass must preserve. use {} only when there are no such details.",
+                    description: "JSON object string with packet-specific structured details. include exact markers, return wording fragments, or constraints the inner pass must preserve; sourceRequest is owned by the runtime from the latest user request. use {} only when there are no such details.",
                 },
                 thought: {
                     type: "string",

package/dist/senses/teams.js

@@ -946,7 +946,7 @@ function registerBotHandlers(app, label) {
         const turnKey = teamsTurnKey(convId);
         // Validate payload — graceful no-op for malformed invocations
         if (activity.value?.actionName !== "feedback" || !reaction) {
-            return;
+            return undefined;
         }
         const syntheticText = buildFeedbackSyntheticText(reaction, comment);
         // Turn coordination: if a turn is active, enqueue as steering follow-up
@@ -957,7 +957,7 @@ function registerBotHandlers(app, label) {
                 receivedAt: Date.now(),
                 effect: (0, continuity_1.classifySteeringFollowUpEffect)(syntheticText),
             });
-            return;
+            return undefined;
         }
         try {
             const teamsContext = {
@@ -978,6 +978,7 @@ function registerBotHandlers(app, label) {
         finally {
             _turnCoordinator.endTurn(turnKey);
         }
+        return undefined;
     });
     /* v8 ignore stop */
     // Handle bot install — send welcome Adaptive Card with prompt starters.
@@ -999,6 +1000,7 @@ function registerBotHandlers(app, label) {
             const msg = err instanceof Error ? err.message : String(err);
             (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.welcome_handler_error", component: "channels", message: msg.slice(0, 200), meta: {} });
         }
+        return undefined;
     });
     /* v8 ignore stop */
     app.on("message", async (ctx) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.641",
+  "version": "0.1.0-alpha.643",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",
@@ -52,12 +52,12 @@
     "@anthropic-ai/sdk": "^0.78.0",
     "@azure/identity": "^4.13.0",
     "@azure/storage-blob": "^12.31.0",
-    "@microsoft/teams.api": "2.0.5",
-    "@microsoft/teams.apps": "^2.0.5",
-    "@microsoft/teams.cards": "2.0.5",
-    "@microsoft/teams.common": "2.0.5",
-    "@microsoft/teams.dev": "^2.0.5",
-    "@microsoft/teams.graph": "2.0.5",
+    "@microsoft/teams.api": "2.0.11",
+    "@microsoft/teams.apps": "2.0.11",
+    "@microsoft/teams.cards": "2.0.11",
+    "@microsoft/teams.common": "2.0.11",
+    "@microsoft/teams.dev": "2.0.11",
+    "@microsoft/teams.graph": "2.0.11",
     "@types/react": "^17.0.91",
     "@types/ws": "^8.18.1",
     "fast-glob": "^3.3.3",
@@ -87,6 +87,9 @@
     "vitest": "^4.0.18"
   },
   "overrides": {
+    "@microsoft/teams.apps": {
+      "@azure/msal-node": "^5.2.2"
+    },
     "@testing-library/react": {
       "react": "$react",
       "@types/react": "$@types/react"