@ouro.bot/cli 0.1.0-alpha.733 → 0.1.0-alpha.734

package/deploy/unraid/sanctuary.ouro/tool-profiles.json

@@ -0,0 +1,21 @@
+{
+  "version": 1,
+  "profiles": {
+    "sanctuary-telegram": [
+      "unraid_list_containers",
+      "unraid_get_container_logs",
+      "unraid_get_storage",
+      "unraid_get_disks",
+      "unraid_get_notifications",
+      "unraid_get_system",
+      "unraid_restart_container",
+      "ponder",
+      "settle",
+      "speak"
+    ],
+    "sanctuary-health-private": [
+      "send_message",
+      "rest"
+    ]
+  }
+}

package/deploy/unraid/sanctuary.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+<Container version="2">
+  <Name>ouro-butler</Name>
+  <Repository>sha256:REPLACE_WITH_EXACT_LOCAL_IMAGE_ID</Repository>
+  <Registry/>
+  <Network>host</Network>
+  <Shell>sh</Shell>
+  <Privileged>false</Privileged>
+  <Support/>
+  <Project/>
+  <Overview>Mendelow Cloud Butler</Overview>
+  <Category>Tools:</Category>
+  <WebUI/>
+  <TemplateURL/>
+  <Icon/>
+  <ExtraParams>--restart=unless-stopped --user=10001:10001</ExtraParams>
+  <PostArgs/>
+  <CPUset/>
+  <DateInstalled>0</DateInstalled>
+  <DonateText/>
+  <DonateLink/>
+  <Requires/>
+  <Config Name="Runtime state" Target="/home/ouro/.ouro-cli" Default="/mnt/user/appdata/ouro-butler/runtime/.ouro-cli" Mode="rw" Description="Machine-scoped runtime" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/ouro-butler/runtime/.ouro-cli</Config>
+  <Config Name="Agent bundle" Target="/home/ouro/AgentBundles/sanctuary.ouro" Default="/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro" Mode="rw" Description="Sanctuary bundle" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro</Config>
+</Container>

package/dist/heart/approval-files.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileApprovalTokenStore = exports.FileApprovalCheckpointStore = void 0;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const tool_approval_1 = require("./tool-approval");
+const runtime_1 = require("../nerves/runtime");
+function readObject(filePath) {
+    try {
+        const value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("state is not an object");
+        return value;
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+            return {};
+        throw new Error(`approval state is corrupt: ${path.basename(filePath)}`, { cause: error });
+    }
+}
+function atomicWrite(filePath, value) {
+    const directory = path.dirname(filePath);
+    fs.mkdirSync(directory, { recursive: true });
+    const temporary = `${filePath}.tmp-${process.pid}-${(0, node_crypto_1.randomUUID)()}`;
+    fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { mode: 0o600 });
+    const temporaryHandle = fs.openSync(temporary, "r");
+    try {
+        fs.fsyncSync(temporaryHandle);
+    }
+    finally {
+        fs.closeSync(temporaryHandle);
+    }
+    fs.renameSync(temporary, filePath);
+    fs.chmodSync(filePath, 0o600);
+    const directoryHandle = fs.openSync(directory, "r");
+    try {
+        fs.fsyncSync(directoryHandle);
+    }
+    finally {
+        fs.closeSync(directoryHandle);
+    }
+}
+class FileApprovalCheckpointStore {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    write(draft) {
+        const checkpoint = {
+            ...structuredClone(draft),
+            checkpointDigest: (0, tool_approval_1.digestApprovalSuspensionCheckpointPayload)(draft),
+            suspendedSessionRevision: draft.baseSessionRevision,
+        };
+        const records = readObject(this.filePath);
+        records[checkpoint.approvalId] = checkpoint;
+        atomicWrite(this.filePath, records);
+        (0, runtime_1.emitNervesEvent)({ component: "engine", event: "engine.approval_checkpoint_written", message: "approval checkpoint written", meta: { approvalId: checkpoint.approvalId } });
+        return { checkpointDigest: checkpoint.checkpointDigest, suspendedSessionRevision: checkpoint.suspendedSessionRevision };
+    }
+    read(approvalId) { return structuredClone(readObject(this.filePath)[approvalId] ?? null); }
+    list() { return Object.values(readObject(this.filePath)).map((record) => structuredClone(record)); }
+    remove(approvalId) {
+        const records = readObject(this.filePath);
+        delete records[approvalId];
+        atomicWrite(this.filePath, records);
+    }
+}
+exports.FileApprovalCheckpointStore = FileApprovalCheckpointStore;
+class FileApprovalTokenStore {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    put(approvalId, token) { const records = readObject(this.filePath); records[approvalId] = token; atomicWrite(this.filePath, records); }
+    has(approvalId) { return approvalId in readObject(this.filePath); }
+    get(approvalId) { return readObject(this.filePath)[approvalId] ?? null; }
+    remove(approvalId) { const records = readObject(this.filePath); delete records[approvalId]; atomicWrite(this.filePath, records); }
+}
+exports.FileApprovalTokenStore = FileApprovalTokenStore;

package/dist/heart/approval-store.js

@@ -40,6 +40,7 @@ exports.ApprovalStoreError = void 0;
 exports.canonicalApprovalArguments = canonicalApprovalArguments;
 exports.parseApprovalRecord = parseApprovalRecord;
 exports.openApprovalStore = openApprovalStore;
+exports.readApprovalsByScenarioHandleDigest = readApprovalsByScenarioHandleDigest;
 const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -162,8 +163,10 @@ function validStateShape(record) {
     if (record.state === "abandoned_before_attempt") {
         const validPreparingRecovery = !hasOwner && record.epoch === 0
             && record.suspendedSessionRevision === null && record.transportMessageId === null;
+        const validPromptBindingRecovery = !hasOwner && record.epoch === 0
+            && hasSuspension && record.transportMessageId === null;
         const validClaimRecovery = hasOwner && record.epoch > 0 && hasSuspension && hasPromptBinding;
-        return (validPreparingRecovery || validClaimRecovery)
+        return (validPreparingRecovery || validPromptBindingRecovery || validClaimRecovery)
             && !hasAttempt && record.result === null && isNonEmpty(record.reason);
     }
     if (record.state === "drifted") {
@@ -483,6 +486,15 @@ function openApprovalStore(options) {
       attempted_at TEXT,
       continued_at TEXT
     )
+    ;
+    CREATE TABLE IF NOT EXISTS approval_acceptance_scenarios (
+      approval_id TEXT PRIMARY KEY,
+      scenario_handle_digest TEXT NOT NULL,
+      FOREIGN KEY (approval_id) REFERENCES approval_actions(approval_id)
+    )
+    ;
+    CREATE INDEX IF NOT EXISTS approval_acceptance_scenario_digest
+      ON approval_acceptance_scenarios (scenario_handle_digest)
   `);
     const now = options.now ?? (() => new Date());
     const randomUUID = options.randomUUID ?? node_crypto_1.randomUUID;
@@ -501,9 +513,22 @@ function openApprovalStore(options) {
             fail("corrupt_record");
         }
     };
-    const insert = (record) => {
-        database.prepare("INSERT INTO approval_actions (approval_id, state, epoch, record_json) VALUES (?, ?, ?, ?)")
-            .run(record.approvalId, record.state, record.epoch, JSON.stringify(record));
+    const insert = (record, scenarioHandleDigest) => {
+        const transaction = database.transaction(() => {
+            database.prepare("INSERT INTO approval_actions (approval_id, state, epoch, record_json) VALUES (?, ?, ?, ?)")
+                .run(record.approvalId, record.state, record.epoch, JSON.stringify(record));
+            if (scenarioHandleDigest)
+                database.prepare("INSERT INTO approval_acceptance_scenarios (approval_id, scenario_handle_digest) VALUES (?, ?)")
+                    .run(record.approvalId, scenarioHandleDigest);
+        });
+        transaction();
+        if (scenarioHandleDigest)
+            (0, runtime_1.emitNervesEvent)({ component: "heart", event: "approval.acceptance_transition", message: "acceptance-bound approval transitioned", meta: { approvalId: record.approvalId, scenarioHandleDigest, toolName: record.toolName, argumentDigest: record.argumentDigest, state: record.state } });
+    };
+    const acceptanceDigest = (approvalId) => {
+        const row = database.prepare("SELECT scenario_handle_digest FROM approval_acceptance_scenarios WHERE approval_id = ?")
+            .get(approvalId);
+        return row?.scenario_handle_digest ?? null;
     };
     const cas = (previous, next) => {
         const changed = database.prepare(`
@@ -512,6 +537,9 @@ function openApprovalStore(options) {
     `).run(next.state, next.epoch, JSON.stringify(next), previous.approvalId, previous.state, previous.epoch, JSON.stringify(previous));
         if (changed.changes !== 1)
             fail("transition_conflict");
+        const scenarioHandleDigest = acceptanceDigest(next.approvalId);
+        if (scenarioHandleDigest)
+            (0, runtime_1.emitNervesEvent)({ component: "heart", event: "approval.acceptance_transition", message: "acceptance-bound approval transitioned", meta: { approvalId: next.approvalId, scenarioHandleDigest, toolName: next.toolName, argumentDigest: next.argumentDigest, state: next.state } });
         return structuredClone(next);
     };
     const requireRecord = (approvalId) => rawRead(approvalId) ?? fail("approval_not_found");
@@ -539,6 +567,9 @@ function openApprovalStore(options) {
     `).run(to, timestamp(), input.approvalId, input.ownerId, input.epoch, from);
         if (changed.changes !== 1)
             fail(`continuation_${to}_not_eligible`);
+        const scenarioHandleDigest = acceptanceDigest(input.approvalId);
+        if (scenarioHandleDigest)
+            (0, runtime_1.emitNervesEvent)({ component: "heart", event: "approval.acceptance_continuation_transition", message: "acceptance-bound approval continuation transitioned", meta: { approvalId: approval.approvalId, scenarioHandleDigest, toolName: approval.toolName, argumentDigest: approval.argumentDigest, state: to } });
         return combineContinuation(approval, readContinuationRow(input.approvalId));
     };
     return {
@@ -585,7 +616,9 @@ function openApprovalStore(options) {
                     reason: null,
                     frozenAssistantMessage: structuredClone(input.frozenAssistantMessage),
                 };
-                insert(parseApprovalRecord(record));
+                if (input.scenarioHandleDigest !== undefined)
+                    assertHash(input.scenarioHandleDigest, "invalid_proposal");
+                insert(parseApprovalRecord(record), input.scenarioHandleDigest);
                 return { record: structuredClone(record), decisionToken };
             });
         },
@@ -602,21 +635,41 @@ function openApprovalStore(options) {
             return observeBindPrompt(() => {
                 const previous = requireRecord(input.approvalId);
                 if (previous.state !== "awaiting_prompt_binding" || input.transport !== previous.transport
-                    || input.transportChatId !== previous.transportChatId || !isNonEmpty(input.transportMessageId))
+                    || input.transportChatId !== previous.transportChatId || !isNonEmpty(input.transportMessageId)
+                    || (input.expiresAt !== undefined && !isTimestamp(input.expiresAt)))
                     fail("invalid_prompt_binding");
-                return cas(previous, { ...previous, state: "proposed", transportMessageId: input.transportMessageId, updatedAt: timestamp() });
+                return cas(previous, { ...previous, state: "proposed", transportMessageId: input.transportMessageId, expiresAt: input.expiresAt ?? previous.expiresAt, updatedAt: timestamp() });
+            });
+        },
+        abandonPromptBinding(input) {
+            return observeAbandonBeforeAttempt(() => {
+                const previous = requireRecord(input.approvalId);
+                if (previous.state === "abandoned_before_attempt" && previous.ownerId === null
+                    && previous.epoch === 0 && previous.reason === input.reason)
+                    return previous;
+                if (previous.state !== "awaiting_prompt_binding" || !isNonEmpty(input.reason))
+                    fail("prompt_abandon_not_eligible");
+                return cas(previous, {
+                    ...previous,
+                    state: "abandoned_before_attempt",
+                    reason: input.reason,
+                    updatedAt: timestamp(),
+                });
             });
         },
         decide(input) {
             return observeDecide(() => {
                 const previous = requireRecord(input.approvalId);
+                const decisionAt = input.decisionAt ?? now().getTime();
+                if (!Number.isSafeInteger(decisionAt))
+                    fail("invalid_decision_time");
                 if (!sameDecisionBinding(previous, input))
                     fail("decision_binding_mismatch");
                 if (previous.state === "denied" && input.decision === "deny")
                     return previous;
                 if (previous.state !== "proposed")
                     fail("decision_not_eligible");
-                if (now().getTime() >= Date.parse(previous.expiresAt)) {
+                if (decisionAt >= Date.parse(previous.expiresAt)) {
                     return cas(previous, { ...previous, state: "expired", updatedAt: timestamp() });
                 }
                 if (input.decision === "deny") {
@@ -625,7 +678,7 @@ function openApprovalStore(options) {
                 if (!isNonEmpty(input.ownerId))
                     fail("invalid_owner");
                 options.hooks?.beforeClaimCas?.();
-                if (now().getTime() >= Date.parse(previous.expiresAt)) {
+                if ((input.decisionAt ?? now().getTime()) >= Date.parse(previous.expiresAt)) {
                     return cas(previous, { ...previous, state: "expired", updatedAt: timestamp() });
                 }
                 return cas(previous, { ...previous, state: "claimed", ownerId: input.ownerId, epoch: previous.epoch + 1, updatedAt: timestamp() });
@@ -753,6 +806,9 @@ function openApprovalStore(options) {
                     interruptedAfterAttempt = terminalized.changes === 1;
                     row = readContinuationRow(input.approvalId);
                 }
+                const scenarioHandleDigest = acceptanceDigest(input.approvalId);
+                if (scenarioHandleDigest)
+                    (0, runtime_1.emitNervesEvent)({ component: "heart", event: "approval.acceptance_continuation_transition", message: "acceptance-bound approval continuation transitioned", meta: { approvalId: approval.approvalId, scenarioHandleDigest, toolName: approval.toolName, argumentDigest: approval.argumentDigest, state: row.state } });
                 return {
                     claimed,
                     interruptedAfterAttempt,
@@ -777,10 +833,87 @@ function openApprovalStore(options) {
         `).run(completedAt, input.approvalId, input.ownerId, input.epoch);
                 if (changed.changes !== 1)
                     fail("continuation_completion_not_eligible");
+                const scenarioHandleDigest = acceptanceDigest(input.approvalId);
+                if (scenarioHandleDigest)
+                    (0, runtime_1.emitNervesEvent)({ component: "heart", event: "approval.acceptance_continuation_transition", message: "acceptance-bound approval continuation transitioned", meta: { approvalId: approval.approvalId, scenarioHandleDigest, toolName: approval.toolName, argumentDigest: approval.argumentDigest, state: "completed" } });
                 return combineContinuation(approval, readContinuationRow(input.approvalId));
             });
         },
         read(approvalId) { return observeRead(() => rawRead(approvalId)); },
+        readByScenarioHandleDigest(scenarioHandleDigest) {
+            assertHash(scenarioHandleDigest, "invalid_scenario_handle_digest");
+            const rows = database.prepare(`
+        SELECT a.record_json
+        FROM approval_actions a
+        INNER JOIN approval_acceptance_scenarios s ON s.approval_id = a.approval_id
+        WHERE s.scenario_handle_digest = ?
+        ORDER BY a.approval_id
+      `).all(scenarioHandleDigest);
+            return rows.map((row) => parseApprovalRecord(JSON.parse(row.record_json)));
+        },
+        listTelegramIdentitySubjects() {
+            const subjects = new Set();
+            const add = (value) => {
+                if (/^tg_[A-Za-z0-9_-]{43}$/u.test(value))
+                    subjects.add(value);
+            };
+            const rows = database.prepare("SELECT record_json FROM approval_actions ORDER BY approval_id")
+                .all();
+            for (const row of rows) {
+                const record = parseApprovalRecord(JSON.parse(row.record_json));
+                if (record.transport !== "telegram")
+                    continue;
+                add(record.requesterId);
+                add(record.transportUserId);
+                add(record.transportChatId);
+                if (record.sessionKey.startsWith("telegram:"))
+                    add(record.sessionKey.slice("telegram:".length));
+                for (const match of record.sessionPath.matchAll(/tg_[A-Za-z0-9_-]{43}/gu))
+                    add(match[0]);
+            }
+            return [...subjects].sort();
+        },
+        migrateTelegramIdentity(input) {
+            if (!isNonEmpty(input.legacyUserId) || !isNonEmpty(input.legacyChatId) || !/^tg_[A-Za-z0-9_-]{43}$/u.test(input.subject)) {
+                fail("invalid_telegram_identity_migration");
+            }
+            const rows = database.prepare("SELECT approval_id, record_json FROM approval_actions ORDER BY approval_id")
+                .all();
+            const migrate = database.transaction(() => {
+                let migrated = 0;
+                for (const row of rows) {
+                    const previous = parseApprovalRecord(JSON.parse(row.record_json));
+                    if (previous.transport !== "telegram")
+                        continue;
+                    const next = {
+                        ...previous,
+                        sessionKey: previous.sessionKey === `telegram:${input.legacyChatId}` ? `telegram:${input.subject}` : previous.sessionKey,
+                        sessionPath: previous.sessionPath
+                            .replace(`telegram-user:${input.legacyUserId}`, `telegram-user:${input.subject}`)
+                            .replace(`telegram_${input.legacyChatId}.json`, `telegram_${input.subject}.json`),
+                        requesterId: previous.requesterId === input.legacyUserId ? input.subject : previous.requesterId,
+                        transportUserId: previous.transportUserId === input.legacyUserId ? input.subject : previous.transportUserId,
+                        transportChatId: previous.transportChatId === input.legacyChatId ? input.subject : previous.transportChatId,
+                        transportMessageId: previous.transportMessageId && !previous.transportMessageId.startsWith("tgm_")
+                            ? `tgm_${(0, node_crypto_1.createHmac)("sha256", input.subject).update(`message:${previous.transportMessageId}`, "utf8").digest("base64url")}`
+                            : previous.transportMessageId,
+                    };
+                    const nextJson = JSON.stringify(parseApprovalRecord(next));
+                    if (nextJson === row.record_json)
+                        continue;
+                    const changed = database.prepare("UPDATE approval_actions SET record_json = ? WHERE approval_id = ? AND record_json = ?")
+                        .run(nextJson, row.approval_id, row.record_json);
+                    if (changed.changes !== 1)
+                        fail("telegram_identity_migration_conflict");
+                    migrated += 1;
+                }
+                return migrated;
+            });
+            const migrated = migrate();
+            if (migrated > 0)
+                database.exec("VACUUM");
+            return migrated;
+        },
         close() {
             return observeClose(() => {
                 options.hooks?.beforeClose?.();
@@ -789,3 +922,29 @@ function openApprovalStore(options) {
         },
     };
 }
+function readApprovalsByScenarioHandleDigest(databasePath, scenarioHandleDigest) {
+    assertHash(scenarioHandleDigest, "invalid_scenario_handle_digest");
+    const database = new better_sqlite3_1.default(databasePath, { readonly: true, fileMustExist: true });
+    try {
+        const rows = database.prepare(`
+      SELECT a.record_json, c.owner_id, c.owner_pid, c.epoch AS continuation_epoch, c.state AS continuation_state,
+        c.claimed_at, c.materialized_at, c.attempted_at AS continuation_attempted_at, c.continued_at
+      FROM approval_actions a
+      INNER JOIN approval_acceptance_scenarios s ON s.approval_id = a.approval_id
+      LEFT JOIN approval_continuations c ON c.approval_id = a.approval_id
+      WHERE s.scenario_handle_digest = ?
+      ORDER BY a.approval_id
+    `).all(scenarioHandleDigest);
+        return rows.map((row) => ({
+            approval: parseApprovalRecord(JSON.parse(row.record_json)),
+            continuation: row.continuation_state === null ? null : {
+                continuationOwnerId: row.owner_id, continuationOwnerPid: row.owner_pid, continuationEpoch: row.continuation_epoch,
+                continuationState: row.continuation_state, continuationClaimedAt: row.claimed_at, continuationMaterializedAt: row.materialized_at,
+                continuationAttemptedAt: row.continuation_attempted_at, continuedAt: row.continued_at,
+            },
+        }));
+    }
+    finally {
+        database.close();
+    }
+}

package/dist/heart/auth/auth-flow.js

@@ -92,7 +92,9 @@ function readAgentConfigForAgent(agentName, bundlesRoot = (0, identity_1.getAgen
         provider !== "anthropic" &&
         provider !== "minimax" &&
         provider !== "openai-codex" &&
-        provider !== "github-copilot") {
+        provider !== "github-copilot" &&
+        provider !== "openai-compatible" &&
+        provider !== "openai-compatible-gemini") {
         throw new Error(`agent.json at ${configPath} has unsupported provider '${String(provider)}'`);
     }
     if (!agentFacing || typeof agentFacing !== "object") {
@@ -106,6 +108,7 @@ function readAgentConfigForAgent(agentName, bundlesRoot = (0, identity_1.getAgen
     const config = {
         ...parsed,
         senses: (0, identity_1.normalizeSenses)(parsed.senses, configPath),
+        habitPaidTurnsPerDay: (0, identity_1.normalizeHabitPaidTurnsPerDay)(agentName, parsed.habitPaidTurnsPerDay, configPath),
     };
     return {
         configPath,
@@ -272,6 +275,19 @@ async function collectRuntimeAuthCredentials(input, deps) {
     const spawnSync = deps.spawnSync ?? child_process_1.spawnSync;
     const homeDir = deps.homeDir ?? os.homedir();
     const now = deps.now ?? (() => new Date());
+    if (input.provider === "openai-compatible" || input.provider === "openai-compatible-gemini") {
+        if (!input.promptSecret)
+            throw new Error(`${input.provider} API key entry requires an interactive terminal so the secret can be hidden.`);
+        const apiKey = (await input.promptSecret(`${input.provider === "openai-compatible" ? "Z.ai" : "Gemini"} API key: `)).trim();
+        if (!apiKey)
+            throw new Error(`${input.provider} API key is required.`);
+        return {
+            apiKey,
+            baseUrl: input.provider === "openai-compatible"
+                ? "https://api.z.ai/api/paas/v4/"
+                : "https://generativelanguage.googleapis.com/v1beta/openai/",
+        };
+    }
     if (input.provider === "github-copilot") {
         let token = process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || "";
         if (!token) {

package/dist/heart/autonomy-budget.js

@@ -33,7 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTONOMY_BUDGET_DEFAULT_POLICY = void 0;
+exports.DEFAULT_HABIT_PAID_TURNS_PER_DAY = exports.AUTONOMY_BUDGET_DEFAULT_POLICY = void 0;
+exports.normalizeHabitPaidTurnsPerDay = normalizeHabitPaidTurnsPerDay;
+exports.resolveAutonomyBudgetPolicy = resolveAutonomyBudgetPolicy;
 exports.autonomyBudgetStatePath = autonomyBudgetStatePath;
 exports.autonomyReceiptsDir = autonomyReceiptsDir;
 exports.readAutonomyBudgetState = readAutonomyBudgetState;
@@ -56,6 +58,47 @@ exports.AUTONOMY_BUDGET_DEFAULT_POLICY = {
     stormFailureWindowMs: 10 * 60 * 1000,
     stormBlockMs: 30 * 60 * 1000,
 };
+exports.DEFAULT_HABIT_PAID_TURNS_PER_DAY = 4;
+function normalizeHabitPaidTurnsPerDay(agentName, value, configFile) {
+    if (value === undefined) {
+        if (agentName === "sanctuary") {
+            throw new Error(`agent.json at ${configFile} must explicitly set habitPaidTurnsPerDay for Sanctuary.`);
+        }
+        return exports.DEFAULT_HABIT_PAID_TURNS_PER_DAY;
+    }
+    if (!Number.isInteger(value) || value < 0 || value > 96) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "config_identity.error",
+            component: "config/identity",
+            message: "agent config has invalid habit paid-turn budget",
+            meta: { path: configFile, value },
+        });
+        throw new Error(`agent.json at ${configFile} habitPaidTurnsPerDay must be an integer from 0 through 96.`);
+    }
+    return value;
+}
+function resolveAutonomyBudgetPolicy(agentRoot, agentName, basePolicy = exports.AUTONOMY_BUDGET_DEFAULT_POLICY) {
+    const configPath = path.join(agentRoot, "agent.json");
+    let configured;
+    if (fs.existsSync(configPath)) {
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(configPath, "utf8"));
+        }
+        catch (error) {
+            throw new Error(`failed to read autonomy budget from ${configPath}: ${String(error)}`);
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error(`agent.json at ${configPath} must be an object`);
+        }
+        configured = parsed.habitPaidTurnsPerDay;
+    }
+    return {
+        ...basePolicy,
+        habitPaidTurnsPerDay: normalizeHabitPaidTurnsPerDay(agentName, configured, configPath),
+    };
+}
 function autonomyRoot(agentRoot) {
     return path.join(agentRoot, "state", "autonomy");
 }

package/dist/heart/awaiting/await-scheduler.js

@@ -50,6 +50,7 @@ class AwaitScheduler {
     onAwaitExpire;
     deps;
     execForVerify;
+    verifyJobs;
     platform;
     watcher = null;
     debounceTimer = null;
@@ -65,6 +66,7 @@ class AwaitScheduler {
         this.onAwaitExpire = options.onAwaitExpire;
         this.deps = options.deps;
         this.execForVerify = options.execForVerify;
+        this.verifyJobs = options.verifyJobs;
         this.platform = options.platform ?? process.platform;
     }
     start() {
@@ -242,9 +244,11 @@ class AwaitScheduler {
         }
     }
     verifyCronAndCreateFallbacks(jobs) {
-        if (!this.execForVerify)
+        if (!this.execForVerify && !this.verifyJobs)
             return;
-        const verifiedLabels = this.verifyCronEntries();
+        const verifiedLabels = this.verifyJobs?.(jobs)
+            ? new Set(jobs.map((job) => this.platform === "darwin" ? `bot.ouro.${job.agent}.${job.taskId}` : job.taskId.replace(/^await\./u, "")))
+            : this.execForVerify ? this.verifyCronEntries() : new Set();
         for (const job of jobs) {
             // job.taskId is already namespaced as "await.<name>". The bare name is
             // what we pass to `--await` and what shows up in the crontab regex

package/dist/heart/config.js

@@ -43,6 +43,7 @@ exports.getMinimaxConfig = getMinimaxConfig;
 exports.getAnthropicConfig = getAnthropicConfig;
 exports.getOpenAICodexConfig = getOpenAICodexConfig;
 exports.getGithubCopilotConfig = getGithubCopilotConfig;
+exports.getOpenAICompatibleConfig = getOpenAICompatibleConfig;
 exports.getTeamsConfig = getTeamsConfig;
 exports.getTeamsSecondaryConfig = getTeamsSecondaryConfig;
 exports.getContextConfig = getContextConfig;
@@ -248,6 +249,13 @@ function getGithubCopilotConfig() {
         baseUrl: typeof raw.baseUrl === "string" ? raw.baseUrl : "",
     };
 }
+function getOpenAICompatibleConfig(provider) {
+    const raw = readProviderConfig(provider);
+    return {
+        apiKey: typeof raw.apiKey === "string" ? raw.apiKey : "",
+        baseUrl: typeof raw.baseUrl === "string" ? raw.baseUrl : "",
+    };
+}
 function getTeamsConfig() {
     const config = loadConfig();
     return { ...config.teams };