@ouro.bot/cli 0.1.0-alpha.735 → 0.1.0-alpha.737

package/changelog.json

@@ -1,6 +1,21 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.737",
+      "changes": [
+        "Ship the integrity-locked Bitwarden CLI in the non-root Unraid runtime so fresh Sanctuary vault access never depends on an impossible runtime install.",
+        "Add a closed final-production acceptance profile with isolated evidence roots while preserving the existing fixed staging path.",
+        "Verify the packed Bitwarden CLI as the non-root runtime user with isolated temporary state, zero stderr, same-layer cleanup, and a read-only constrained-tmpfs image probe."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.736",
+      "changes": [
+        "Fix the packaged Unraid image build to honor the repository peer dependency install contract.",
+        "Keep release lock metadata aligned and gate publication on building the packed Unraid image."
+      ]
+    },
     {
       "version": "0.1.0-alpha.735",
       "changes": [

package/deploy/unraid/Dockerfile

@@ -12,7 +12,9 @@ RUN apt-get update \
 
 WORKDIR /opt/ouro
 COPY package.json npm-shrinkwrap.json ./
-RUN npm ci --omit=dev --workspaces=false --no-audit --no-fund
+RUN npm ci --omit=dev --legacy-peer-deps --workspaces=false --no-audit --no-fund \
+  && test -x /opt/ouro/node_modules/.bin/bw \
+  && ln -s /opt/ouro/node_modules/.bin/bw /usr/local/bin/bw
 COPY dist ./dist
 COPY assets ./assets
 COPY skills ./skills
@@ -23,5 +25,19 @@ RUN chown -R 10001:10001 /opt/ouro /home/ouro
 
 USER 10001:10001
 ENV HOME=/home/ouro
+RUN BW_VERIFY_ROOT="$(mktemp -d)" \
+  && trap 'rm -rf -- "$BW_VERIFY_ROOT"' 0 \
+  && mkdir "$BW_VERIFY_ROOT/appdata" \
+  && printf '%s' '{}' >"$BW_VERIFY_ROOT/appdata/data.json" \
+  && test ! -e "/home/ouro/.config/Bitwarden CLI" \
+  && test "$(id -u)" = "10001" \
+  && test "$(id -g)" = "10001" \
+  && command -v bw >/dev/null \
+  && BW_VERSION="$(BITWARDENCLI_APPDATA_DIR="$BW_VERIFY_ROOT/appdata" bw --version 2>"$BW_VERIFY_ROOT/stderr")" \
+  && test ! -s "$BW_VERIFY_ROOT/stderr" \
+  && test "$BW_VERSION" = "2026.8.0" \
+  && rm -rf -- "$BW_VERIFY_ROOT" \
+  && trap - 0 \
+  && test ! -e "/home/ouro/.config/Bitwarden CLI"
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 CMD ["node","/opt/ouro/dist/heart/daemon/container-healthcheck.js","--agent","sanctuary"]
 ENTRYPOINT ["node","/opt/ouro/dist/heart/daemon/daemon-entry.js"]

package/deploy/unraid/README.txt

@@ -1386,8 +1386,10 @@ Packaged deployment-target containment gates:
   types (including datagrams) fail closed. Inherited descriptors for the same
   socket inode are deduplicated, while unknown loopback ports, wildcard/host-address
   listeners, process/socket/listener drift, or ambiguous ownership fail closed.
-  Unit 18 uses the separately packaged fixed final command, after rollback has
-  been retained stopped:
+  Unit 18 uses the separately packaged fixed final command after activation.
+  It accepts either the legacy-adoption topology with no canonical rollback or
+  exactly one stopped, non-autostarted rollback; running/autostarted rollback,
+  staging presence, and ambiguous canonical identities always fail closed:
     UNIT18_TARGET_TMP=$(mktemp /run/sanctuary-unit18-target-audit.sh.XXXXXX)
     /usr/bin/timeout -s KILL 20 /usr/bin/docker run --rm --pull=never --network none \
       --entrypoint /bin/cat "$IMAGE_ID" /opt/ouro/deploy/unraid/sanctuary-unit18-target-audit.sh >"$UNIT18_TARGET_TMP"
@@ -1406,6 +1408,16 @@ Packaged Unit 16 acceptance execution:
       --entrypoint /bin/cat "$IMAGE_ID" /opt/ouro/deploy/unraid/sanctuary-unit16-run.sh >"$UNIT16_LAUNCHER_TMP"
     install -m 0755 -o root -g root "$UNIT16_LAUNCHER_TMP" "$UNIT16_ROOT/sanctuary-unit16-run.sh"
     rm -f -- "$UNIT16_LAUNCHER_TMP"
+  After final activation, create the disjoint final-profile roots and invoke the
+  same immutable launcher with its only non-staging selector. The selector is a
+  closed `staging|final` enum; it never accepts a container name, ID, or path:
+    UNIT18_ROOT=/mnt/user/appdata/ouro-butler/acceptance/final
+    install -d -m 0700 -o 10001 -g 10001 "$UNIT18_ROOT/configs" "$UNIT18_ROOT/evidence"
+    "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final materialize evidence-snapshot
+    "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final evidence-snapshot evidence-snapshot.json
+  Use `--profile final` on every final pre-reboot and post-reboot materialize/run
+  command. Omitting it remains the byte-for-byte Unit 16 staging path. Never mix
+  staging and final config/evidence roots or reuse a config across profiles.
   Never hand-author a Unit 16 config. Materialize it from the exact image, then
   execute it in the order below. Before every execution the launcher regenerates
   the config from the packaged fixed contract and requires byte-for-byte equality.

package/deploy/unraid/sanctuary-acceptance-contract.json

@@ -5,8 +5,8 @@
   "adapterTimeoutMs": 240000,
   "telegramTimeoutMs": 10000,
   "deploymentTargetProfiles": {
-    "staging": { "command": "sanctuary-unit16-run.sh", "containerName": "ouro-butler-staging", "requiredRunning": 1, "restartPolicy": "unless-stopped", "networkMode": "host", "inboundTcpListeners": 0, "inboundUdpListeners": 0, "loopbackTcpControls": [6876] },
-    "final": { "command": "sanctuary-unit18-target-audit.sh", "containerName": "ouro-butler", "requiredRunning": 1, "requiredStopped": "ouro-butler-rollback", "restartPolicy": "unless-stopped", "networkMode": "host", "inboundTcpListeners": 0, "inboundUdpListeners": 0, "loopbackTcpControls": [6876] }
+    "staging": { "command": "sanctuary-unit16-run.sh", "acceptanceInvocation": "sanctuary-unit16-run.sh <image-id> ...", "containerName": "ouro-butler-staging", "requiredRunning": 1, "restartPolicy": "unless-stopped", "networkMode": "host", "inboundTcpListeners": 0, "inboundUdpListeners": 0, "loopbackTcpControls": [6876] },
+    "final": { "command": "sanctuary-unit18-target-audit.sh", "acceptanceInvocation": "sanctuary-unit16-run.sh <image-id> --profile final ...", "containerName": "ouro-butler", "requiredRunning": 1, "optionalStopped": "ouro-butler-rollback", "restartPolicy": "unless-stopped", "networkMode": "host", "inboundTcpListeners": 0, "inboundUdpListeners": 0, "loopbackTcpControls": [6876] }
   },
   "configMaterializer": {
     "invocation": "sanctuary-acceptance-adapter.sh materialize-config <command> [before|after]",

package/deploy/unraid/sanctuary-deployment-target.mjs

@@ -11,8 +11,8 @@ const IMAGE_ID = /^sha256:[0-9a-f]{64}$/u
 const CONTAINER_ID = /^[0-9a-f]{64}$/u
 const CANONICAL_NAMES = ["ouro-butler", "ouro-butler-staging", "ouro-butler-rollback"]
 const PROFILES = Object.freeze({
-  staging: Object.freeze({ name: "staging", containerName: "ouro-butler-staging", requiredStopped: [], forbidden: ["ouro-butler", "ouro-butler-rollback"] }),
-  final: Object.freeze({ name: "final", containerName: "ouro-butler", requiredStopped: ["ouro-butler-rollback"], forbidden: ["ouro-butler-staging"] }),
+  staging: Object.freeze({ name: "staging", containerName: "ouro-butler-staging", requiredStopped: [], optionalStopped: [], forbidden: ["ouro-butler", "ouro-butler-rollback"] }),
+  final: Object.freeze({ name: "final", containerName: "ouro-butler", requiredStopped: [], optionalStopped: ["ouro-butler-rollback"], forbidden: ["ouro-butler-staging"] }),
 })
 const DOCUMENTED_UNIX_CONTROLS = [
   "/tmp/ouroboros-daemon.sock",
@@ -133,6 +133,10 @@ function attestDeploymentTarget(input) {
     const stopped = byName.get(name)
     if (!stopped || stopped.running || stopped.autoStart) throw new Error("required rollback target state is invalid")
   }
+  for (const name of profile.optionalStopped) {
+    const stopped = byName.get(name)
+    if (stopped && (stopped.running || stopped.autoStart)) throw new Error("optional rollback target state is invalid")
+  }
   for (const name of profile.forbidden) if (byName.has(name)) throw new Error("mixed deployment target state is invalid")
   const activeRunningCardinality = inspected.filter(({ running }) => running).length
   if (activeRunningCardinality !== 1) throw new Error("active Butler running cardinality must equal one")

package/deploy/unraid/sanctuary-unit16-host-broker.mjs

@@ -168,7 +168,21 @@ function autostartFileExact() {
     : counts.production === 1 && counts.staging === 0 && counts.rollback === 0 && counts.legacy === 0
 }
 
-async function queryGraphqlAutostart(records = inventoryRecords(), fetchImpl = fetch, expectedContainerId = activeContainerId, profile = activeProfile) {
+function optionalStoppedContainerExact(name, containerId, run = spawnSync) {
+  if (name !== "ouro-butler-rollback" || !SHA256.test(containerId)) return false
+  const template = '{"containerId":{{json .Id}},"name":{{json .Name}},"running":{{json .State.Running}}}'
+  const result = run(DOCKER, ["inspect", "--format", template, containerId], {
+    cwd: "/", encoding: "utf8", timeout: 20_000, maxBuffer: 64 * 1024,
+    env: { PATH: "/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin" }, stdio: ["ignore", "pipe", "ignore"],
+  })
+  if (result.error || result.status !== 0) return false
+  try {
+    const value = object(JSON.parse(result.stdout ?? ""), "optional rollback inspection")
+    return value.containerId === containerId && value.name === `/${name}` && value.running === false
+  } catch { return false }
+}
+
+async function queryGraphqlAutostart(records = inventoryRecords(), fetchImpl = fetch, expectedContainerId = activeContainerId, profile = activeProfile, inspectOptionalStopped = optionalStoppedContainerExact) {
   text(expectedContainerId, "attested target container id", SHA256)
   const matches = records.filter((record) => record.name === "Butler RO" && record.roles.length === 0
     && JSON.stringify(flattened(record)) === JSON.stringify(RO_PERMISSIONS))
@@ -200,12 +214,16 @@ async function queryGraphqlAutostart(records = inventoryRecords(), fetchImpl = f
     if (!identity || identity[1] !== serverIdentity[1] || typeof container.autoStart !== "boolean" || topology.has(canonical[0])) return false
     topology.set(canonical[0], { containerId: identity[2], autoStart: container.autoStart })
   }
-  const expectedNames = new Set([profile.containerName, ...profile.requiredStopped])
-  if (topology.size !== expectedNames.size || [...expectedNames].some((name) => !topology.has(name))
+  const requiredNames = new Set([profile.containerName, ...profile.requiredStopped])
+  const allowedNames = new Set([...requiredNames, ...profile.optionalStopped])
+  if ([...requiredNames].some((name) => !topology.has(name)) || [...topology.keys()].some((name) => !allowedNames.has(name))
     || profile.forbidden.some((name) => topology.has(name))) return false
   const target = topology.get(profile.containerName)
   if (!target || target.containerId !== expectedContainerId || target.autoStart !== true) return false
-  return profile.requiredStopped.every((name) => topology.get(name)?.autoStart === false)
+  return [...profile.requiredStopped, ...profile.optionalStopped].every((name) => {
+    const stopped = topology.get(name)
+    return !stopped || (stopped.autoStart === false && inspectOptionalStopped(name, stopped.containerId))
+  })
 }
 
 function updaterDisabled(expectedImage) {
@@ -1763,6 +1781,7 @@ export {
   productionProcessBindingDigest,
   observeRebootPreflight,
   parseVaultStatus,
+  optionalStoppedContainerExact,
   queryGraphqlAutostart,
   readBoundedProcStatus,
   driveDuplicateCallbacks,

package/deploy/unraid/sanctuary-unit16-run.sh

@@ -1,15 +1,33 @@
 #!/bin/sh
 set -eu
 
-CONFIG_ROOT=/mnt/user/appdata/ouro-butler/acceptance/configs
-EVIDENCE_ROOT=/mnt/user/appdata/ouro-butler/acceptance/evidence
 RUNTIME_ROOT=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli
 BUNDLE_ROOT=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro
+test "$#" -ge 1 || exit 2
+IMAGE_ID=$1
+shift
 TARGET_PROFILE=staging
-PRODUCTION_CONTAINER=ouro-butler-staging
+if test "${1:-}" = --profile; then
+  test "$#" -ge 2 || exit 2
+  TARGET_PROFILE=$2
+  shift 2
+fi
+case "$TARGET_PROFILE" in
+  staging)
+    CONFIG_ROOT=/mnt/user/appdata/ouro-butler/acceptance/configs
+    EVIDENCE_ROOT=/mnt/user/appdata/ouro-butler/acceptance/evidence
+    PRODUCTION_CONTAINER=ouro-butler-staging
+    ;;
+  final)
+    CONFIG_ROOT=/mnt/user/appdata/ouro-butler/acceptance/final/configs
+    EVIDENCE_ROOT=/mnt/user/appdata/ouro-butler/acceptance/final/evidence
+    PRODUCTION_CONTAINER=ouro-butler
+    ;;
+  *) exit 2 ;;
+esac
 TARGET_CONTAINER_ID=
-IMAGE_ID=${1:-}
-MODE=${2:-}
+MODE=${1:-}
+case "$MODE" in --*) exit 2 ;; esac
 BROKER_PID=
 PRIVATE_ROOT=
 PRODUCTION_STOPPED=no
@@ -57,26 +75,16 @@ cleanup_unit16() {
 }
 trap cleanup_unit16 EXIT HUP INT TERM
 
-IMAGE_DIGEST=${IMAGE_ID#sha256:}
-test "$IMAGE_DIGEST" != "$IMAGE_ID" || exit 2
-test "${#IMAGE_DIGEST}" -eq 64 || exit 2
-case "$IMAGE_DIGEST" in *[!0-9a-f]*) exit 2 ;; esac
-test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker image inspect --format '{{.Id}}' "$IMAGE_ID")" = "$IMAGE_ID" || exit 1
-test -d "$CONFIG_ROOT" && test ! -L "$CONFIG_ROOT" || exit 1
-test -d "$EVIDENCE_ROOT" && test ! -L "$EVIDENCE_ROOT" || exit 1
-test "$(stat -c '%u:%g %a' "$CONFIG_ROOT")" = "10001:10001 700" || exit 1
-test "$(stat -c '%u:%g %a' "$EVIDENCE_ROOT")" = "10001:10001 700" || exit 1
-
 case "$MODE" in
   materialize)
-    test "$#" -eq 3 || { test "$#" -eq 4 && test "$3" = cursor-snapshot; } || exit 2
-    COMMAND=${3:-}
-    PHASE=${4:-}
+    test "$#" -eq 2 || { test "$#" -eq 3 && test "$2" = cursor-snapshot; } || exit 2
+    COMMAND=${2:-}
+    PHASE=${3:-}
     ;;
   *)
-    test "$#" -eq 3 || exit 2
+    test "$#" -eq 2 || exit 2
     COMMAND=$MODE
-    CONFIG_NAME=${3:-}
+    CONFIG_NAME=${2:-}
     ;;
 esac
 case "$COMMAND" in
@@ -84,6 +92,16 @@ case "$COMMAND" in
   *) exit 2 ;;
 esac
 
+IMAGE_DIGEST=${IMAGE_ID#sha256:}
+test "$IMAGE_DIGEST" != "$IMAGE_ID" || exit 2
+test "${#IMAGE_DIGEST}" -eq 64 || exit 2
+case "$IMAGE_DIGEST" in *[!0-9a-f]*) exit 2 ;; esac
+test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker image inspect --format '{{.Id}}' "$IMAGE_ID")" = "$IMAGE_ID" || exit 1
+test -d "$CONFIG_ROOT" && test ! -L "$CONFIG_ROOT" || exit 1
+test -d "$EVIDENCE_ROOT" && test ! -L "$EVIDENCE_ROOT" || exit 1
+test "$(stat -c '%u:%g %a' "$CONFIG_ROOT")" = "10001:10001 700" || exit 1
+test "$(stat -c '%u:%g %a' "$EVIDENCE_ROOT")" = "10001:10001 700" || exit 1
+
 PRIVATE_ROOT=$(mktemp -d /run/ouro-unit16.XXXXXX)
 chmod 0700 "$PRIVATE_ROOT"
 chown 0:0 "$PRIVATE_ROOT"
@@ -114,10 +132,10 @@ start_broker() {
   TARGET_CONTAINER_ID=$(/usr/local/bin/node -e '
     const fs = require("node:fs"); const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8")); const deployment = value && value.deployment;
     if (value?.schemaVersion !== "sanctuary-effective-deployment-v1" || deployment?.schemaVersion !== "sanctuary-deployment-target-v1"
-      || deployment.profile !== "staging" || deployment.targetContainerName !== "ouro-butler-staging"
+      || deployment.profile !== process.argv[3] || deployment.targetContainerName !== process.argv[4]
       || deployment.targetImageId !== process.argv[2] || !/^[0-9a-f]{64}$/.test(deployment.targetContainerId)) process.exit(1);
     process.stdout.write(deployment.targetContainerId);
-  ' "$PRIVATE_ROOT/deployment-target.json" "$IMAGE_ID")
+  ' "$PRIVATE_ROOT/deployment-target.json" "$IMAGE_ID" "$TARGET_PROFILE" "$PRODUCTION_CONTAINER")
   test -n "$TARGET_CONTAINER_ID" || return 1
   /usr/local/bin/node "$BROKER_PROGRAM" "$TARGET_PROFILE" "$TARGET_CONTAINER_ID" "$BROKER_SOCKET" "$CLOSED_INVENTORY" "$IMAGE_ID" "$BROKER_SNAPSHOT" </dev/null >/dev/null 2>&1 &
   BROKER_PID=$!