@ouro.bot/cli 0.1.0-alpha.754 → 0.1.0-alpha.756

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.756",
+      "changes": [
+        "Recover private-runtime turns safely across container restarts and restore Sanctuary steward-policy context."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.755",
+      "changes": [
+        "Preserve canonical Telegram owner identity across restarts.",
+        "Validate and accept SAB array or object server stats without failing open on malformed or unsafe counts."
+      ]
+    },
     {
       "version": "0.1.0-alpha.754",
       "changes": [

package/deploy/unraid/ouro-events/usenet-health.sh

@@ -88,13 +88,11 @@ if [ "$Q_STATUS" = "Idle" ] && [ "${Q_SLOTS:-0}" -gt 0 ]; then STALLED=1; fi
 MIN_ARTICLES=50000
 MIN_RATE=30
 TODAY=$(date +%Y-%m-%d)
-fetch_sab_json STATS 20 "http://localhost:8090/api?mode=server_stats&output=json" '(.servers | type) == "array"' "server-stats" || exit 1
-TRIED=$(echo "$STATS" | jq -r --arg d "$TODAY" '[.servers[].articles_tried[$d] // 0] | add // 0' 2>/dev/null)
-OKAY=$(echo "$STATS" | jq -r --arg d "$TODAY" '[.servers[].articles_success[$d] // 0] | add // 0' 2>/dev/null)
-BYTES=$(echo "$STATS" | jq -r --arg d "$TODAY" '[.servers[].daily[$d] // 0] | add // 0' 2>/dev/null)
-case "$TRIED" in ''|*[!0-9]*) TRIED=0 ;; esac
-case "$OKAY" in ''|*[!0-9]*) OKAY=0 ;; esac
-case "$BYTES" in ''|*[!0-9]*) BYTES=0 ;; esac
+fetch_sab_json STATS 20 "http://localhost:8090/api?mode=server_stats&output=json" 'def valid_count: ((type == "number" and . >= 0 and . <= 9007199254740991 and floor == .) or (type == "string" and test("^[0-9]+$") and (tonumber <= 9007199254740991))); ((.servers | type) == "array" or (.servers | type) == "object") and (.servers | length) > 0 and all(.servers[]; (type == "object") and (.articles_tried | type) == "object" and (.articles_success | type) == "object" and (.daily | type) == "object" and all(.articles_tried[]; valid_count) and all(.articles_success[]; valid_count) and all(.daily[]; valid_count))' "server-stats" || exit 1
+if ! IFS=$'\t' read -r TRIED OKAY BYTES < <(printf '%s' "$STATS" | jq -er --arg d "$TODAY" 'def count: if type == "number" and . >= 0 and . <= 9007199254740991 and floor == . then . elif type == "string" and test("^[0-9]+$") and (tonumber <= 9007199254740991) then tonumber else error("invalid server count") end; def total($field): ([.servers[] | (.[$field][$d] // 0) | count] | add) as $total | if $total >= 0 and $total <= 9007199254740991 and ($total | floor) == $total then $total else error("invalid aggregate server count") end; [total("articles_tried"), total("articles_success"), total("daily")] | @tsv' 2>/dev/null); then
+    emit_blind_observation "server-stats-response"
+    exit 1
+fi
 GB=$(( ${BYTES:-0} / 1000000000 ))
 
 BASE_DAY=""

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.754",
+  "runtimeVersion": "0.1.0-alpha.756",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-08-30T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>Mendelow Cloud Butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.754</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.756</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/mind/session-transaction.js

@@ -51,6 +51,7 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
 const runtime_1 = require("../nerves/runtime");
+const habit_lifecycle_1 = require("../heart/habits/habit-lifecycle");
 class SessionTurnBusyError extends Error {
     retryable = true;
     constructor(message = "session turn is busy") {
@@ -101,34 +102,71 @@ function openLeaseDatabase(lockPath, busyTimeoutMs = 0) {
       owner_token TEXT NOT NULL
     )
   `);
+    const columns = new Set(database.prepare(`PRAGMA table_info(session_turn_lease)`).all().map((column) => column.name));
+    if (!columns.has("boot_identity"))
+        database.exec(`ALTER TABLE session_turn_lease ADD COLUMN boot_identity TEXT`);
+    if (!columns.has("process_started_at"))
+        database.exec(`ALTER TABLE session_turn_lease ADD COLUMN process_started_at TEXT`);
     return database;
 }
-function claimLeaseRecord(lockPath, record, isProcessAlive) {
+function acquisitionRecord(options) {
+    const pid = options.pid ?? process.pid;
+    const bootIdentity = (options.getBootIdentity ?? habit_lifecycle_1.probeHabitBootIdentity)();
+    const processStartedAt = (options.getProcessStartedAt ?? habit_lifecycle_1.probeHabitProcessStartedAt)(pid);
+    if (!bootIdentity || !processStartedAt)
+        throw new SessionTransactionError("current process identity is unavailable");
+    return {
+        pid,
+        ownerId: options.ownerId ?? (0, node_crypto_1.randomUUID)(),
+        ownerToken: options.ownerToken ?? (0, node_crypto_1.randomUUID)(),
+        bootIdentity,
+        processStartedAt,
+    };
+}
+function claimLeaseRecord(lockPath, record, isProcessAlive, getProcessStartedAt) {
     const database = openLeaseDatabase(lockPath);
     try {
         return database.transaction(() => {
             const current = database.prepare(`
-        SELECT pid, owner_id, owner_token FROM session_turn_lease WHERE singleton = 1
+        SELECT pid, owner_id, owner_token, boot_identity, process_started_at FROM session_turn_lease WHERE singleton = 1
       `).get();
             if (!current) {
                 database.prepare(`
-          INSERT INTO session_turn_lease (singleton, pid, owner_id, owner_token) VALUES (1, ?, ?, ?)
-        `).run(record.pid, record.ownerId, record.ownerToken);
+          INSERT INTO session_turn_lease (singleton, pid, owner_id, owner_token, boot_identity, process_started_at) VALUES (1, ?, ?, ?, ?, ?)
+        `).run(record.pid, record.ownerId, record.ownerToken, record.bootIdentity, record.processStartedAt);
                 return { acquired: true, stale: null };
             }
             if (!Number.isSafeInteger(current.pid) || current.pid <= 0
                 || typeof current.owner_id !== "string" || current.owner_id.length === 0
-                || typeof current.owner_token !== "string" || current.owner_token.length === 0) {
+                || typeof current.owner_token !== "string" || current.owner_token.length === 0
+                || !((current.boot_identity === null && current.process_started_at === null)
+                    || (typeof current.boot_identity === "string" && current.boot_identity.length > 0
+                        && typeof current.process_started_at === "string" && current.process_started_at.length > 0))) {
                 throw new SessionTransactionError("invalid session lease record");
             }
-            const observed = { pid: current.pid, ownerId: current.owner_id, ownerToken: current.owner_token };
-            if (isProcessAlive(observed.pid))
+            const observed = {
+                pid: current.pid,
+                ownerId: current.owner_id,
+                ownerToken: current.owner_token,
+                bootIdentity: current.boot_identity,
+                processStartedAt: current.process_started_at,
+            };
+            const differentBoot = observed.bootIdentity !== null && observed.bootIdentity !== record.bootIdentity;
+            let differentProcess = false;
+            if (observed.bootIdentity !== null && !differentBoot) {
+                const liveStartedAt = getProcessStartedAt(observed.pid);
+                differentProcess = liveStartedAt !== null && liveStartedAt !== observed.processStartedAt;
+                if (liveStartedAt === observed.processStartedAt)
+                    return { acquired: false, stale: null };
+            }
+            if (!differentBoot && !differentProcess && isProcessAlive(observed.pid))
                 return { acquired: false, stale: null };
-            database.prepare(`
-        UPDATE session_turn_lease SET pid = ?, owner_id = ?, owner_token = ?
+            const changed = database.prepare(`
+        UPDATE session_turn_lease SET pid = ?, owner_id = ?, owner_token = ?, boot_identity = ?, process_started_at = ?
         WHERE singleton = 1 AND pid = ? AND owner_id = ? AND owner_token = ?
-      `).run(record.pid, record.ownerId, record.ownerToken, observed.pid, observed.ownerId, observed.ownerToken);
-            return { acquired: true, stale: observed };
+          AND boot_identity IS ? AND process_started_at IS ?
+      `).run(record.pid, record.ownerId, record.ownerToken, record.bootIdentity, record.processStartedAt, observed.pid, observed.ownerId, observed.ownerToken, observed.bootIdentity, observed.processStartedAt).changes;
+            return changed === 1 ? { acquired: true, stale: observed } : { acquired: false, stale: null };
         })();
     }
     finally {
@@ -140,7 +178,8 @@ function releaseLeaseRecord(lockPath, record) {
     try {
         return database.prepare(`
       DELETE FROM session_turn_lease WHERE singleton = 1 AND pid = ? AND owner_id = ? AND owner_token = ?
-    `).run(record.pid, record.ownerId, record.ownerToken).changes === 1;
+        AND boot_identity IS ? AND process_started_at IS ?
+    `).run(record.pid, record.ownerId, record.ownerToken, record.bootIdentity, record.processStartedAt).changes === 1;
     }
     finally {
         database.close();
@@ -180,9 +219,8 @@ async function acquireSessionTurnLease(sessionPath, options = {}) {
             return makeLease(existing);
         }
     }
-    const ownerId = options.ownerId ?? (0, node_crypto_1.randomUUID)();
-    const ownerToken = options.ownerToken ?? (0, node_crypto_1.randomUUID)();
-    const pid = options.pid ?? process.pid;
+    const record = acquisitionRecord(options);
+    const { ownerId } = record;
     const timeoutMs = options.timeoutMs ?? 5_000;
     const pollIntervalMs = options.pollIntervalMs ?? 10;
     const isProcessAlive = options.isProcessAlive ?? processAlive;
@@ -192,14 +230,14 @@ async function acquireSessionTurnLease(sessionPath, options = {}) {
     for (;;) {
         let claim = null;
         try {
-            claim = claimLeaseRecord(lockPath, { pid, ownerId, ownerToken }, isProcessAlive);
+            claim = claimLeaseRecord(lockPath, record, isProcessAlive, options.getProcessStartedAt ?? habit_lifecycle_1.probeHabitProcessStartedAt);
         }
         catch (error) {
             if (!isSqliteBusy(error))
                 throw error;
         }
         if (claim?.acquired) {
-            const held = { sessionPath: canonical, lockPath, pid, ownerId, ownerToken, depth: 1, released: false };
+            const held = { sessionPath: canonical, lockPath, ...record, depth: 1, released: false };
             heldLeases.set(canonical, held);
             (0, runtime_1.emitNervesEvent)({
                 component: "mind",
@@ -246,15 +284,13 @@ function withImmediateSessionTurnLease(sessionPath, work, options = {}) {
     const contextual = currentSessionTurnLease(canonical);
     if (contextual)
         return work(contextual);
-    const ownerId = options.ownerId ?? (0, node_crypto_1.randomUUID)();
-    const ownerToken = options.ownerToken ?? (0, node_crypto_1.randomUUID)();
-    const pid = options.pid ?? process.pid;
+    const record = acquisitionRecord(options);
     const lockPath = `${canonical}.turn.lock`;
     fs.mkdirSync(path.dirname(canonical), { recursive: true });
     const tryAcquire = () => {
         let claim;
         try {
-            claim = claimLeaseRecord(lockPath, { pid, ownerId, ownerToken }, options.isProcessAlive ?? processAlive);
+            claim = claimLeaseRecord(lockPath, record, options.isProcessAlive ?? processAlive, options.getProcessStartedAt ?? habit_lifecycle_1.probeHabitProcessStartedAt);
         }
         catch (error) {
             if (isSqliteBusy(error))
@@ -262,7 +298,7 @@ function withImmediateSessionTurnLease(sessionPath, work, options = {}) {
             throw error;
         }
         if (claim.acquired) {
-            const held = { sessionPath: canonical, lockPath, pid, ownerId, ownerToken, depth: 1, released: false };
+            const held = { sessionPath: canonical, lockPath, ...record, depth: 1, released: false };
             heldLeases.set(canonical, held);
             if (claim.stale) {
                 options.onStaleLease?.(claim.stale);

package/dist/senses/private-runtime-worker.js

@@ -515,6 +515,7 @@ function createPrivateRuntimeWorker(runTurn = (options) => (0, private_runtime_1
                 const currentHabitName = nextHabitName;
                 const currentTrigger = nextTrigger ?? "overdue";
                 const currentNoSend = nextNoSend;
+                const currentExternalEvent = nextExternalEvent;
                 const currentExternalEventHeartbeat = nextExternalEventHeartbeat;
                 nextExternalEventHeartbeat = undefined;
                 const currentHabitRun = currentReason === "habit" && currentHabitName
@@ -655,6 +656,11 @@ function createPrivateRuntimeWorker(runTurn = (options) => (0, private_runtime_1
                 // would cause hasPendingWork() to be true here, producing a
                 // self-sustaining "instinct" loop with no external input. Cap it.
                 if (hasPendingWork(currentHabitRun?.paths.pendingDir)) {
+                    if (currentExternalEvent && (turnErrors.length > 0
+                        || (turnResult && typeof turnResult === "object" && "turnOutcome" in turnResult && turnResult.turnOutcome === "errored"))) {
+                        finalizeCurrentHabitRun();
+                        break;
+                    }
                     clearHeartbeatRestShield();
                     if (consecutiveInstinctTurns >= exports.MAX_CONSECUTIVE_INSTINCT_TURNS) {
                         (0, runtime_1.emitNervesEvent)({

package/dist/senses/sanctuary-runtime.js

@@ -120,10 +120,10 @@ function persistAttempt(filePath, attempt) {
     fs.writeFileSync(temporary, `${JSON.stringify(attempt)}\n`, { mode: 0o600 });
     fs.renameSync(temporary, filePath);
 }
-async function appendAcceptanceAttempt(agentName, attempt) {
+async function appendAcceptanceAttempt(agentRoot, attempt) {
     if (!attempt.scenarioHandleDigest)
         return;
-    const filePath = path.join((0, identity_1.getAgentRoot)(agentName), "state", "acceptance", "restart-attempts.ndjson");
+    const filePath = path.join(agentRoot, "state", "acceptance", "restart-attempts.ndjson");
     const previous = acceptanceLedgerTails.get(filePath) ?? Promise.resolve();
     const current = previous.catch(() => undefined).then(() => {
         fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
@@ -187,6 +187,7 @@ function createSanctuaryToolContext(agentName) {
         message: "creating typed Sanctuary tool context",
         meta: { agentName },
     });
+    const agentRoot = (0, identity_1.getAgentRoot)(agentName);
     const initial = machineConfig(agentName);
     const endpoint = required(initial, "unraidGraphqlUrl");
     const readClient = new unraid_client_1.UnraidClient({ endpoint, apiKey: required(initial, "unraidReadApiKey") });
@@ -216,15 +217,16 @@ function createSanctuaryToolContext(agentName) {
         listContainers: reads.listContainers,
         loadWriteApiKey: async () => required(machineConfig(agentName), "unraidWriteApiKey"),
         persistAttempt: async (attempt) => {
-            persistAttempt(path.join((0, identity_1.getAgentRoot)(agentName), "state", "approvals", "unraid-restart-attempt.json"), attempt);
-            await appendAcceptanceAttempt(agentName, attempt);
+            persistAttempt(path.join(agentRoot, "state", "approvals", "unraid-restart-attempt.json"), attempt);
+            await appendAcceptanceAttempt(agentRoot, attempt);
         },
         acceptanceScenarioHandleDigest: () => (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)(agentName)?.scenarioHandleDigest,
         acceptanceApproval: sanctuary_acceptance_marker_1.readSanctuaryAcceptanceApproval,
-        reserveRoutineAction: (input) => (0, steward_policy_1.consumeRoutineActionGrant)((0, identity_1.getAgentRoot)(agentName), input),
-        transitionRoutineAction: (input) => (0, steward_policy_1.transitionRoutineActionReceipt)((0, identity_1.getAgentRoot)(agentName), input),
+        reserveRoutineAction: (input) => (0, steward_policy_1.consumeRoutineActionGrant)(agentRoot, input),
+        transitionRoutineAction: (input) => (0, steward_policy_1.transitionRoutineActionReceipt)(agentRoot, input),
     });
     return {
+        agentRoot,
         sanctuary: {
             listContainers: acceptanceRead("unraid_list_containers", reads.listContainers),
             getContainerLogs: acceptanceRead("unraid_get_container_logs", reads.getContainerLogs),
@@ -255,7 +257,7 @@ function createSanctuaryToolContext(agentName) {
                 collectToolResult(result);
                 return result;
             },
-            recoverRoutineActions: () => (0, steward_policy_1.recoverRoutineActionReceipts)((0, identity_1.getAgentRoot)(agentName), {
+            recoverRoutineActions: () => (0, steward_policy_1.recoverRoutineActionReceipts)(agentRoot, {
                 observeTarget: async (target) => {
                     const observed = await reads.listContainers();
                     if (!observed.ok)

package/dist/senses/telegram.js

@@ -924,12 +924,14 @@ function createTelegramSenseApp(options) {
             acceptanceAuditBarrier();
             migrateTelegramSessionIdentity(agentRoot, legacySubject, legacySubject, subject);
             acceptanceAuditBarrier();
-            await migrateTelegramFriendIdentity(agentRoot, legacySubject, subject);
+            if (!options.admission)
+                await migrateTelegramFriendIdentity(agentRoot, legacySubject, subject);
         }
         acceptanceAuditBarrier();
         migrateTelegramSessionIdentity(agentRoot, authorizedUserId, authorizedChatId, subject);
         acceptanceAuditBarrier();
-        await migrateTelegramFriendIdentity(agentRoot, authorizedUserId, subject);
+        if (!options.admission)
+            await migrateTelegramFriendIdentity(agentRoot, authorizedUserId, subject);
         acceptanceAuditBarrier();
         approvalRuntime?.migrateIdentity?.(migrationSubjects);
         acceptanceAuditBarrier();

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.754",
+  "version": "0.1.0-alpha.756",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.754",
+      "version": "0.1.0-alpha.756",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.754",
+  "version": "0.1.0-alpha.756",
   "engines": {
     "node": ">=22"
   },