@ouro.bot/cli 0.1.0-alpha.762 → 0.1.0-alpha.764

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.764",
+      "changes": [
+        "Allow the Sanctuary Telegram bootstrap acceptance command to persist merged runtime credentials while preserving read-only containment for every other acceptance path."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.763",
+      "changes": [
+        "Keep the Unit 16 host broker response channel open until asynchronous operations return a bounded success or failure envelope."
+      ]
+    },
     {
       "version": "0.1.0-alpha.762",
       "changes": [

package/deploy/unraid/sanctuary-unit16-host-broker.mjs

@@ -1707,21 +1707,9 @@ function writeClosedInventory(file) {
   chownSync(file, 0, 0)
 }
 
-async function main() {
-  if (process.getuid?.() !== 0) throw new Error("host broker must run as root")
-  const [profileName, targetContainerId, socket, closedInventory, expectedImage, initialSnapshot] = process.argv.slice(2)
-  if (!profileName || !targetContainerId || !socket || !closedInventory || !expectedImage || !initialSnapshot || process.argv.length !== 8) throw new Error("usage: broker <staging|final> <target-container-id> <socket> <closed-inventory> <expected-image-id> <initial-snapshot>")
-  activeProfile = targetProfile(profileName)
-  activeContainer = activeProfile.containerName
-  activeContainerId = text(targetContainerId, "attested target container id", SHA256)
-  expectedImageId = text(expectedImage, "expected image id", IMAGE_ID)
-  rmSync(socket, { force: true })
-  writeClosedInventory(closedInventory)
-  const snapshot = await containerSnapshot(expectedImageId)
-  const snapshotFd = openSync(initialSnapshot, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600)
-  try { writeFileSync(snapshotFd, `${JSON.stringify(snapshot)}\n`); fsyncSync(snapshotFd) } finally { closeSync(snapshotFd) }
-  chownSync(initialSnapshot, 0, 0)
-  const server = createServer((connection) => {
+function createBrokerServer(dispatchRequest = dispatch) {
+  const dispatchDrain = createDispatchDrain()
+  const server = createServer({ allowHalfOpen: true }, (connection) => {
     let input = ""
     connection.setEncoding("utf8")
     connection.on("data", (chunk) => {
@@ -1730,14 +1718,31 @@ async function main() {
     })
     connection.on("end", async () => {
       try {
-        const result = await dispatchDrain.run(() => dispatch(JSON.parse(input)))
+        const result = await dispatchDrain.run(() => dispatchRequest(JSON.parse(input)))
         const scenario = result?.[ASYNC_RESTART_SCENARIO]
         const completed = scenario ? armRestartAfterResponseClosed(connection, scenario) : undefined
         connection.end(`${JSON.stringify({ ok: true, result })}\n`, completed)
       } catch { connection.end(`${JSON.stringify({ ok: false, error: "host operation failed" })}\n`) }
     })
   })
-  const dispatchDrain = createDispatchDrain()
+  return { server, dispatchDrain }
+}
+
+async function main() {
+  if (process.getuid?.() !== 0) throw new Error("host broker must run as root")
+  const [profileName, targetContainerId, socket, closedInventory, expectedImage, initialSnapshot] = process.argv.slice(2)
+  if (!profileName || !targetContainerId || !socket || !closedInventory || !expectedImage || !initialSnapshot || process.argv.length !== 8) throw new Error("usage: broker <staging|final> <target-container-id> <socket> <closed-inventory> <expected-image-id> <initial-snapshot>")
+  activeProfile = targetProfile(profileName)
+  activeContainer = activeProfile.containerName
+  activeContainerId = text(targetContainerId, "attested target container id", SHA256)
+  expectedImageId = text(expectedImage, "expected image id", IMAGE_ID)
+  rmSync(socket, { force: true })
+  writeClosedInventory(closedInventory)
+  const snapshot = await containerSnapshot(expectedImageId)
+  const snapshotFd = openSync(initialSnapshot, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600)
+  try { writeFileSync(snapshotFd, `${JSON.stringify(snapshot)}\n`); fsyncSync(snapshotFd) } finally { closeSync(snapshotFd) }
+  chownSync(initialSnapshot, 0, 0)
+  const { server, dispatchDrain } = createBrokerServer()
   server.listen(socket, () => {
     chownSync(socket, 0, 10001)
     chmodSync(socket, 0o660)
@@ -1769,6 +1774,7 @@ export {
   armRestartAfterResponseClosed,
   completeHealthProbeFromReceipt,
   createDispatchDrain,
+  createBrokerServer,
   createHealthProbeOperationCoordinator,
   createOwnerMutationCoordinator,
   createInteractiveRestartDriver,

package/deploy/unraid/sanctuary-unit16-run.sh

@@ -411,7 +411,7 @@ run_harness() {
       --user 10001:10001 --read-only --cap-drop ALL --security-opt no-new-privileges \
       --mount "type=bind,src=$CONFIG_PATH,dst=/run/ouro-acceptance/config.json,readonly" \
       --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence" \
-      --mount "type=bind,src=$RUNTIME_ROOT,dst=/home/ouro/.ouro-cli,readonly" \
+      --mount "type=bind,src=$RUNTIME_ROOT,dst=/home/ouro/.ouro-cli" \
       --mount "type=bind,src=$BUNDLE_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro$BUNDLE_SUFFIX" \
       --mount "type=bind,src=$POLLER_FACT,dst=/run/ouro-acceptance/telegram-poller-count.json,readonly" \
       --mount "type=bind,src=$IMAGE_FACT,dst=/run/ouro-acceptance/image-digest,readonly" \

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.762",
+  "runtimeVersion": "0.1.0-alpha.764",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-08-30T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>Mendelow Cloud Butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.762</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.764</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.762",
+  "version": "0.1.0-alpha.764",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.762",
+      "version": "0.1.0-alpha.764",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.762",
+  "version": "0.1.0-alpha.764",
   "engines": {
     "node": ">=22"
   },