@ouro.bot/cli 0.1.0-alpha.660 → 0.1.0-alpha.661

package/changelog.json

@@ -1,6 +1,13 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.661",
+      "changes": [
+        "Default the local machine owner (the OS user running the daemon) to family trust when first encountered as a friend, instead of stranger. The Workbench boss check-in resolves the machine owner as a `local` friend; because MCP tool calls are trust-gated, a stranger-level owner caused the boss's own runtime-injected `ouro_workbench` machine-introspection tools to be rejected with the trust guardrail (\"i'd need a closer friend to vouch for you\"). The person running the daemon owns the agent and its bundle, so they are family, not a stranger.",
+        "Adds the pure `isLocalMachineOwnerIdentity` predicate and an injectable `machineOwnerUsername()` detection seam so the owner default is deterministically testable; resolver friend-creation is fully covered."
+      ]
+    },
     {
       "version": "0.1.0-alpha.660",
       "changes": [

package/dist/mind/friends/resolver.js

@@ -4,10 +4,45 @@
 // Replaces the old ContextResolver: no authority checker, no separate note resolution.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FriendResolver = void 0;
+exports._setMachineOwnerUsernameForTest = _setMachineOwnerUsernameForTest;
+exports.machineOwnerUsername = machineOwnerUsername;
+exports.isLocalMachineOwnerIdentity = isLocalMachineOwnerIdentity;
 const crypto_1 = require("crypto");
+const os_1 = require("os");
 const channel_1 = require("./channel");
 const runtime_1 = require("../../nerves/runtime");
 const CURRENT_SCHEMA_VERSION = 1;
+// Test seam: when set (including to null), overrides OS detection of the
+// machine-owner username so resolver tests are deterministic.
+let machineOwnerOverride;
+function _setMachineOwnerUsernameForTest(value) {
+    machineOwnerOverride = value;
+}
+/**
+ * The OS username that owns this daemon process, or null if undetectable. The
+ * person running the daemon owns this agent + its bundle, so the local friend
+ * that names them is the machine owner (family), not a stranger.
+ */
+function machineOwnerUsername() {
+    if (machineOwnerOverride !== undefined)
+        return machineOwnerOverride;
+    try {
+        return (0, os_1.userInfo)().username;
+    }
+    catch {
+        /* v8 ignore next -- defensive: userInfo() only throws when the running user has no passwd entry @preserve */
+        return null;
+    }
+}
+/**
+ * True when (provider, externalId) names the local machine owner — the OS user
+ * running the daemon. Matches the bare username or a `user@host` external id.
+ */
+function isLocalMachineOwnerIdentity(provider, externalId, ownerUsername) {
+    if (provider !== "local" || !ownerUsername)
+        return false;
+    return externalId === ownerUsername || externalId.startsWith(`${ownerUsername}@`);
+}
 class FriendResolver {
     store;
     params;
@@ -88,6 +123,11 @@ class FriendResolver {
         }
         const isFirstImprint = !hasAnyFriends;
         const isA2AAgent = this.params.provider === "a2a-agent";
+        // The local friend that names the OS user running the daemon is the machine
+        // owner (family) — they own the agent + its bundle. Usually this friend already
+        // exists as a family/primary hatch imprint; this covers the un-imprinted boss
+        // path (e.g. a Workbench boss check-in on a bundle that skipped imprint).
+        const isLocalMachineOwner = isLocalMachineOwnerIdentity(this.params.provider, this.params.externalId, machineOwnerUsername());
         // BlueBubbles group chats route through here as `imessage-handle` with an
         // externalId of the form `group:any;+;<chatHash>`. When the harness auto-
         // creates the group friend at stranger trust, we mark the record so that
@@ -106,8 +146,8 @@ class FriendResolver {
         const friend = {
             id: (0, crypto_1.randomUUID)(),
             name: this.params.displayName,
-            role: isA2AAgent ? "agent-peer" : isFirstImprint ? "primary" : "stranger",
-            trustLevel: isA2AAgent ? "stranger" : isFirstImprint ? "family" : "stranger",
+            role: isA2AAgent ? "agent-peer" : isFirstImprint ? "primary" : isLocalMachineOwner ? "family" : "stranger",
+            trustLevel: isA2AAgent ? "stranger" : (isFirstImprint || isLocalMachineOwner) ? "family" : "stranger",
             connections: [],
             externalIds: [externalId],
             tenantMemberships,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.660",
+  "version": "0.1.0-alpha.661",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",