@ouro.bot/cli 0.1.0-alpha.733 → 0.1.0-alpha.735

package/dist/repertoire/unraid-restart.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANCTUARY_RESTART_MUTATION = void 0;
+exports.createApprovedUnraidRestartExecutor = createApprovedUnraidRestartExecutor;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+const unraid_client_1 = require("./unraid-client");
+exports.SANCTUARY_RESTART_MUTATION = `mutation SanctuaryRestart($id: PrefixedID!) {
+  docker { restart(id: $id) { id names state status autoStart } }
+}`;
+function failure(code, message) {
+    return { ok: false, error: { code, message, degraded: true } };
+}
+function exactTarget(result, name) {
+    if (!result.ok)
+        return failure("invalid_response", result.error.message);
+    const matches = result.data.containers.filter((container) => container.name === name);
+    if (matches.length === 0)
+        return failure("not_found", `container '${name}' was not found`);
+    if (matches.length !== 1)
+        return failure("ambiguous", `container '${name}' is ambiguous`);
+    return matches[0];
+}
+function validArgument(value) {
+    return typeof value === "string" && value.length > 0 && Buffer.byteLength(value, "utf8") <= 128 && !value.includes("\uFFFD");
+}
+function acknowledgedIdentity(data, target) {
+    const docker = data.docker;
+    if (!docker || typeof docker !== "object" || Array.isArray(docker))
+        return false;
+    const restart = docker.restart;
+    if (!restart || typeof restart !== "object" || Array.isArray(restart))
+        return false;
+    const record = restart;
+    return record.id === target.id && Array.isArray(record.names)
+        && record.names.length === 1 && String(record.names[0]).replace(/^\//u, "") === target.name;
+}
+function createApprovedUnraidRestartExecutor(options) {
+    const createClient = options.createClient ?? ((input) => new unraid_client_1.UnraidClient(input));
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    const now = options.now ?? (() => new Date());
+    const observationTimeoutMs = options.observationTimeoutMs ?? 30_000;
+    return async (args) => {
+        if (!validArgument(args.container))
+            return failure("invalid_response", "container must be one bounded exact name");
+        const resolved = exactTarget(await options.listContainers(), args.container);
+        if ("ok" in resolved)
+            return resolved;
+        const fresh = exactTarget(await options.listContainers(), args.container);
+        if ("ok" in fresh)
+            return fresh;
+        if (fresh.id !== resolved.id)
+            return failure("stale_target", "container identity changed before restart");
+        const scenarioHandleDigest = options.acceptanceScenarioHandleDigest?.();
+        const approval = options.acceptanceApproval?.();
+        const attempt = {
+            container: { id: fresh.id, name: fresh.name },
+            beforeState: fresh.state,
+            observedAt: now().toISOString(),
+            actionDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify({ operation: "restart", container: { id: fresh.id, name: fresh.name } })).digest("hex"),
+            argumentDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify({ container: args.container })).digest("hex"),
+            ...(scenarioHandleDigest ? { scenarioHandleDigest } : {}),
+            ...(approval ? { approvalId: approval.approvalId } : {}),
+            attemptId: (0, node_crypto_1.randomUUID)(),
+            mutationAcknowledged: false,
+            afterState: null,
+        };
+        if (approval && approval.argumentDigest !== attempt.argumentDigest)
+            return failure("stale_target", "approval arguments changed before restart");
+        await options.persistAttempt?.({ ...attempt, observedAt: now().toISOString(), state: "attempt_not_started" });
+        const apiKey = await options.loadWriteApiKey();
+        if (!apiKey.trim())
+            return failure("invalid_response", "Unraid write credential is unavailable");
+        const client = createClient({ endpoint: options.endpoint, apiKey });
+        await options.persistAttempt?.({ ...attempt, observedAt: now().toISOString(), state: "attempting" });
+        (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.unraid_restart_start", message: "approved Unraid restart started", meta: { containerId: fresh.id, containerName: fresh.name } });
+        const persistTerminal = async (terminal) => {
+            try {
+                await options.persistAttempt?.(terminal);
+                return true;
+            }
+            catch (error) {
+                (0, runtime_1.emitNervesEvent)({ level: "error", component: "repertoire", event: "repertoire.unraid_restart_error", message: "approved Unraid restart terminal receipt persistence failed", meta: { containerId: fresh.id, category: error instanceof Error ? error.name : "unknown" } });
+                return false;
+            }
+        };
+        let acknowledged = false;
+        try {
+            const mutation = await client.mutate(exports.SANCTUARY_RESTART_MUTATION, { id: fresh.id });
+            acknowledged = acknowledgedIdentity(mutation, fresh);
+            if (!acknowledged)
+                throw new Error("restart response identity was invalid");
+        }
+        catch {
+            acknowledged = false;
+        }
+        const startedAt = now().getTime();
+        let sawRestarting = false;
+        try {
+            do {
+                const observed = exactTarget(await options.listContainers(), args.container);
+                if (!("ok" in observed)) {
+                    if (observed.id !== fresh.id) {
+                        await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "attempted_or_indeterminate", mutationAcknowledged: acknowledged });
+                        return failure("ambiguous", "container identity changed after restart attempt");
+                    }
+                    sawRestarting ||= observed.state === "restarting";
+                    if (observed.state === "running" && !observed.degraded && (acknowledged || sawRestarting)) {
+                        if (!await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "succeeded", mutationAcknowledged: acknowledged, afterState: observed.state })) {
+                            return failure("ambiguous", "restart succeeded but its terminal receipt could not be persisted; it was not retried");
+                        }
+                        (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.unraid_restart_end", message: "approved Unraid restart completed", meta: { containerId: fresh.id, observedRestart: true } });
+                        return { ok: true, data: { container: { id: fresh.id, name: fresh.name }, beforeState: fresh.state, afterState: observed.state, observedRestart: true, degraded: false } };
+                    }
+                }
+                if (now().getTime() - startedAt >= observationTimeoutMs)
+                    break;
+                await sleep(1_000);
+            } while (true);
+        }
+        catch {
+            await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "attempted_or_indeterminate", mutationAcknowledged: acknowledged });
+            (0, runtime_1.emitNervesEvent)({ level: "error", component: "repertoire", event: "repertoire.unraid_restart_error", message: "approved Unraid restart observation failed", meta: { containerId: fresh.id, acknowledged } });
+            return failure("ambiguous", "restart was attempted but observation failed; it was not retried");
+        }
+        await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "attempted_or_indeterminate", mutationAcknowledged: acknowledged });
+        (0, runtime_1.emitNervesEvent)({ level: "error", component: "repertoire", event: "repertoire.unraid_restart_error", message: "approved Unraid restart outcome was ambiguous", meta: { containerId: fresh.id, acknowledged } });
+        return failure("ambiguous", "restart was attempted but could not be proven; it was not retried");
+    };
+}

package/dist/senses/private-runtime-worker.js

@@ -146,15 +146,16 @@ function reserveHabitAutonomyBudget(habitRun, nowIso) {
         target.rsvpBudgetRef = habitRun.rsvpPolicy.budgetRef;
         target.rsvpIdempotencyRef = habitRun.rsvpPolicy.idempotencyRef;
     }
+    const agentName = (0, identity_1.getAgentName)();
     return (0, autonomy_budget_1.reserveAutonomyBudget)(habitRun.agentRoot, {
-        agent: (0, identity_1.getAgentName)(),
+        agent: agentName,
         triggerType: "habit",
         sourceKind: "private-runtime",
         senseOrHabit: habitRun.habit.name,
         target,
         idempotencyKey: `habit:${habitRun.habit.name}:${habitRun.runId}`,
         now: nowIso,
-    });
+    }, (0, autonomy_budget_1.resolveAutonomyBudgetPolicy)(habitRun.agentRoot, agentName));
 }
 /**
  * Cap on consecutive `instinct` follow-on turns triggered by `hasPendingWork()`

package/dist/senses/sanctuary-grounding.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanctuaryGroundingDigest = sanctuaryGroundingDigest;
+exports.projectSanctuaryGrounding = projectSanctuaryGrounding;
+exports.renderSanctuaryGroundedResponse = renderSanctuaryGroundedResponse;
+exports.sanctuaryGroundedResponseAccurate = sanctuaryGroundedResponseAccurate;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+function object(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    return value;
+}
+function sanctuaryGroundingDigest(facts) {
+    return (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(facts)).digest("hex");
+}
+function projectSanctuaryGrounding(toolName, result) {
+    if (toolName !== "unraid_get_system" && toolName !== "unraid_get_storage")
+        return null;
+    const envelope = object(result, "Sanctuary grounding result");
+    if (envelope.ok !== true)
+        throw new Error("Sanctuary grounding result must succeed");
+    const data = object(envelope.data, "Sanctuary grounding data");
+    if (toolName === "unraid_get_system") {
+        const exact = ["apiVersion", "arrayState", "degraded", "serverName", "sourceIdentityDigest", "unraidVersion", "uptimeSeconds"];
+        if (JSON.stringify(Object.keys(data).sort()) !== JSON.stringify(exact))
+            throw new Error("Sanctuary system grounding shape is invalid");
+        for (const key of ["serverName", "unraidVersion", "apiVersion", "arrayState"])
+            if (typeof data[key] !== "string" || !data[key])
+                throw new Error("Sanctuary system grounding value is invalid");
+        if (typeof data.degraded !== "boolean" || (data.uptimeSeconds !== null && (!Number.isSafeInteger(data.uptimeSeconds) || Number(data.uptimeSeconds) < 0)))
+            throw new Error("Sanctuary system grounding value is invalid");
+        const facts = { serverName: data.serverName, unraidVersion: data.unraidVersion, apiVersion: data.apiVersion, arrayState: data.arrayState, degraded: data.degraded };
+        (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_grounding_projected", message: "Sanctuary grounding facts projected", meta: { toolName } });
+        return facts;
+    }
+    const exact = ["array", "shares", "sourceIdentityDigest", "truncated"];
+    if (JSON.stringify(Object.keys(data).sort()) !== JSON.stringify(exact) || !Array.isArray(data.shares) || typeof data.truncated !== "boolean")
+        throw new Error("Sanctuary storage grounding shape is invalid");
+    const array = object(data.array, "Sanctuary storage array grounding");
+    if (JSON.stringify(Object.keys(array).sort()) !== JSON.stringify(["degraded", "freeBytes", "state", "usedBytes", "usedPercent"]))
+        throw new Error("Sanctuary storage array grounding shape is invalid");
+    if (typeof array.state !== "string" || !array.state || typeof array.degraded !== "boolean"
+        || ![array.usedBytes, array.freeBytes].every((value) => value === null || (Number.isSafeInteger(value) && Number(value) >= 0))
+        || (array.usedPercent !== null && (typeof array.usedPercent !== "number" || !Number.isFinite(array.usedPercent))))
+        throw new Error("Sanctuary storage array grounding value is invalid");
+    const { sourceIdentityDigest: _sourceIdentityDigest, ...facts } = data;
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_grounding_projected", message: "Sanctuary grounding facts projected", meta: { toolName } });
+    return structuredClone(facts);
+}
+function normalized(value) {
+    return value.normalize("NFKC").toLocaleLowerCase("en-US");
+}
+function regexEscape(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+function systemResponseAccurate(facts, response) {
+    if (typeof facts.serverName !== "string" || typeof facts.unraidVersion !== "string" || typeof facts.arrayState !== "string" || typeof facts.degraded !== "boolean")
+        return false;
+    const pattern = new RegExp(`^${regexEscape(normalized(facts.serverName))} is running unraid ${regexEscape(normalized(facts.unraidVersion))}(?:; the array is| with the array) ${regexEscape(normalized(facts.arrayState))} and (not degraded|healthy|nominal|degraded|unhealthy)\\.?$`, "u");
+    const match = pattern.exec(response);
+    if (!match)
+        return false;
+    return facts.degraded ? match[1] === "degraded" || match[1] === "unhealthy" : match[1] === "not degraded" || match[1] === "healthy" || match[1] === "nominal";
+}
+function byteAmount(amount, unit) {
+    const divisors = { tb: 1_000_000_000_000, tib: 1_099_511_627_776, gb: 1_000_000_000, gib: 1_073_741_824, byte: 1, bytes: 1 };
+    return Number(amount) * divisors[unit];
+}
+function storageResponseAccurate(facts, response) {
+    const array = object(facts.array, "Sanctuary response storage facts");
+    if (typeof array.freeBytes !== "number" || typeof array.usedPercent !== "number" || typeof array.state !== "string" || typeof array.degraded !== "boolean")
+        return false;
+    const pattern = /^(?:there is|about) (\d+(?:\.\d+)?)\s*(tb|tib|gb|gib|bytes?) (?:is )?(?:available|free|left)(?:;|,| and) (?:(?:the array is )(\d+(?:\.\d+)?)\s*%\s*(?:used|full)|(?:usage is )(\d+(?:\.\d+)?)\s*%)\.(?: the array is ([\p{L}\p{N}_-]+) and (not degraded|healthy|nominal|degraded|unhealthy)\.)?$/u;
+    const match = pattern.exec(response);
+    if (!match)
+        return false;
+    const bytesAccurate = Math.abs(byteAmount(match[1], match[2]) - array.freeBytes) <= Math.max(1, array.freeBytes * 0.025);
+    const percentAccurate = Math.abs(Number(match[3] ?? match[4]) - array.usedPercent) <= 0.51;
+    if (!bytesAccurate || !percentAccurate)
+        return false;
+    if (match[5] === undefined && match[6] === undefined)
+        return true;
+    const healthAccurate = array.degraded ? match[6] === "degraded" || match[6] === "unhealthy" : match[6] === "not degraded" || match[6] === "healthy" || match[6] === "nominal";
+    return normalized(String(match[5])) === normalized(array.state) && healthAccurate;
+}
+function compactNumber(value) {
+    return value.toFixed(2).replace(/\.0+$/u, "").replace(/(\.\d*?)0+$/u, "$1");
+}
+function renderSanctuaryGroundedResponse(toolName, facts) {
+    let response;
+    if (toolName === "unraid_get_system") {
+        if (typeof facts.serverName !== "string" || typeof facts.unraidVersion !== "string" || typeof facts.arrayState !== "string" || typeof facts.degraded !== "boolean")
+            throw new Error("Sanctuary system response facts are invalid");
+        response = `${facts.serverName} is running Unraid ${facts.unraidVersion} with the array ${facts.arrayState} and ${facts.degraded ? "degraded" : "not degraded"}.`;
+    }
+    else {
+        const array = object(facts.array, "Sanctuary storage response facts");
+        if (typeof array.freeBytes !== "number" || typeof array.usedPercent !== "number")
+            throw new Error("Sanctuary storage response facts are invalid");
+        const units = [[1_000_000_000_000, "TB"], [1_000_000_000, "GB"], [1, "bytes"]];
+        const freeBytes = Number(array.freeBytes);
+        const usedPercent = Number(array.usedPercent);
+        const [divisor, unit] = units.find(([candidate]) => freeBytes >= candidate) ?? units[units.length - 1];
+        response = `There is ${compactNumber(freeBytes / divisor)} ${unit} free and the array is ${compactNumber(usedPercent)}% used.`;
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.sanctuary_grounded_response_rendered",
+        message: "Rendered a deterministic Sanctuary response from grounded facts",
+        meta: { toolName },
+    });
+    return response;
+}
+function sanctuaryGroundedResponseAccurate(toolName, facts, responseText) {
+    const response = normalized(responseText);
+    return toolName === "unraid_get_system" ? systemResponseAccurate(facts, response) : storageResponseAccurate(facts, response);
+}

package/dist/senses/sanctuary-health-acceptance-probe-entry.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const sanctuary_health_acceptance_probe_1 = require("./sanctuary-health-acceptance-probe");
+const runtime_1 = require("../nerves/runtime");
+(0, runtime_1.emitNervesEvent)({
+    component: "senses",
+    event: "senses.entry_boot",
+    message: "booting Sanctuary health acceptance probe entrypoint",
+    meta: { entry: "sanctuary-health-acceptance-probe" },
+});
+(0, sanctuary_health_acceptance_probe_1.startSanctuaryHealthAcceptanceProbeCli)(process.argv.slice(2), (0, sanctuary_health_acceptance_probe_1.createSanctuaryHealthAcceptanceProbeCliOutput)());