@ouro.bot/cli 0.1.0-alpha.767 → 0.1.0-alpha.769

package/dist/senses/sanctuary-full-visibility-contract.js

@@ -1,11 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSanctuaryCurrentStatusIntent = isSanctuaryCurrentStatusIntent;
 exports.sanctuaryFullVisibilityEmptyResponse = sanctuaryFullVisibilityEmptyResponse;
 exports.sanctuaryFullVisibilityRequiredToolCalls = sanctuaryFullVisibilityRequiredToolCalls;
+exports.sanctuaryStaleDockerCareRequiredToolCalls = sanctuaryStaleDockerCareRequiredToolCalls;
+const node_crypto_1 = require("node:crypto");
+const cares_1 = require("../arc/cares");
 const runtime_1 = require("../nerves/runtime");
-const REQUIRED_TOOL_NAMES = ["query_active_work", "query_cares", "unraid_get_system", "unraid_list_containers", "unraid_get_storage", "sanctuary_get_download_queue"];
+const REQUIRED_TOOL_NAMES = ["query_active_work", "query_cares", "unraid_get_system", "unraid_list_containers", "unraid_get_storage", "unraid_get_notifications", "sanctuary_get_download_queue"];
 const WHOLE_STATUS_REQUESTS = new Set(["what are you working on", "what's going on with sanctuary"]);
-function unsupportedCurrentClaim(answer, queueUnavailable) {
+function unsupportedCurrentClaim(answer, queueUnavailable, authorizedDockerClaims) {
     if (queueUnavailable && answer.trim().length === 0)
         return "Give Ari the current results that did complete and say plainly that the download queue is currently unavailable; do not return an empty answer.";
     if (queueUnavailable) {
@@ -21,6 +25,9 @@ function unsupportedCurrentClaim(answer, queueUnavailable) {
     const unsupported = answer.replace(/docker\.img/giu, "docker image").split(/[,;!?\n]|(?<!\d)\.(?!\d)/u).some((sentence) => {
         if (!/docker image(?: disk)?/iu.test(sentence))
             return false;
+        const normalizedSentence = sentence.normalize("NFKC").trim().toLocaleLowerCase("en-US");
+        if (authorizedDockerClaims.some((claim) => claim.normalize("NFKC").replace(/[.!?]+$/u, "").trim().toLocaleLowerCase("en-US") === normalizedSentence))
+            return false;
         const uncertaintyOnly = /\b(?:cannot|can't|unable to) (?:currently )?(?:verify|measure)\b|\b(?:unknown|unverified)\b|\bneeds? (?:a )?(?:fresh |authoritative )*(?:check|measurement)\b/iu.test(sentence);
         const stateClaim = /\b\d+(?:\.\d+)?\s*%|\bfull\b|\b(?:no|out of) space\b|\bwrites? (?:will |may )?fail\b|\b(?:healthy|unhealthy|running|stopped)\b/iu.test(sentence);
         return stateClaim || !uncertaintyOnly;
@@ -59,6 +66,19 @@ function successfulCurrentResult(name, result) {
         const parsed = JSON.parse(result);
         if (name === "query_cares")
             return { valid: Array.isArray(parsed), queueUnavailable: false };
+        if (name === "unraid_get_notifications") {
+            const root = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+            const error = root?.error && typeof root.error === "object" && !Array.isArray(root.error) ? root.error : null;
+            const unavailable = root?.ok === false
+                && JSON.stringify(Object.keys(root).sort()) === JSON.stringify(["error", "ok"])
+                && !!error && JSON.stringify(Object.keys(error).sort()) === JSON.stringify(["code", "degraded", "message"])
+                && ["unauthorized", "forbidden", "timeout", "transport", "graphql", "invalid_response"].includes(String(error.code))
+                && typeof error.message === "string" && Buffer.byteLength(error.message, "utf8") <= 512 && error.degraded === true;
+            if (unavailable)
+                return { valid: true, queueUnavailable: false };
+            const data = root?.data && typeof root.data === "object" && !Array.isArray(root.data) ? root.data : null;
+            return { valid: root?.ok === true && Array.isArray(data?.unacknowledged) && typeof data.truncated === "boolean", queueUnavailable: false };
+        }
         if (name === "sanctuary_get_download_queue") {
             if (exactQueueUnavailableResult(parsed))
                 return { valid: true, queueUnavailable: true };
@@ -80,23 +100,37 @@ function successfulCurrentResult(name, result) {
     }
 }
 function normalizedRequest(request) {
-    return request.normalize("NFKC").trim().toLocaleLowerCase("en-US").replaceAll("’", "'").replace(/[?!.\s]+$/gu, "");
+    return request.normalize("NFKC").trim().toLocaleLowerCase("en-US").replace(/[‘’]/gu, "'").replace(/[^a-z0-9']+/gu, " ").trim();
+}
+function isSanctuaryCurrentStatusIntent(request) {
+    const normalized = normalizedRequest(request);
+    if (WHOLE_STATUS_REQUESTS.has(normalized))
+        return true;
+    if (["what's up", "everything good", "anything wrong"].includes(normalized))
+        return true;
+    if (!normalized || /\b(?:yesterday|tomorrow|document|movie request)\b/u.test(normalized))
+        return false;
+    if (/^do you care about\b/u.test(normalized) || /\b(?:plex|jellyfin|sonarr|radarr|docker labels?)\b/u.test(normalized))
+        return false;
+    const wholeScope = /\b(?:anything|everything|what(?:'s| is)|things?)\b/u.test(normalized);
+    const current = /\b(?:now|right now|currently|going on|status)\b/u.test(normalized);
+    const concern = /\b(?:care about|should (?:i|we) know about|working on|going on|status)\b/u.test(normalized);
+    return wholeScope && current && concern;
 }
 function sanctuaryFullVisibilityEmptyResponse(request) {
-    return WHOLE_STATUS_REQUESTS.has(normalizedRequest(request))
+    return isSanctuaryCurrentStatusIntent(request)
         ? "I couldn't finish a trustworthy Sanctuary status check because a current check was unavailable. I won't guess or reuse old alerts; please try again shortly."
         : undefined;
 }
-function sanctuaryFullVisibilityRequiredToolCalls(request, advertisedToolNames) {
-    const normalized = normalizedRequest(request);
-    if (!WHOLE_STATUS_REQUESTS.has(normalized) || !REQUIRED_TOOL_NAMES.every((name) => advertisedToolNames.includes(name)))
+function sanctuaryFullVisibilityRequiredToolCalls(request, _advertisedToolNames, authorizedDockerClaims = () => []) {
+    if (!isSanctuaryCurrentStatusIntent(request))
         return undefined;
     (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_full_visibility_reads_required", message: "required current Sanctuary visibility reads", meta: { toolCount: REQUIRED_TOOL_NAMES.length } });
     let queueUnavailable = false;
     const completed = new Set();
     return {
         names: REQUIRED_TOOL_NAMES,
-        retryMessage: "Before answering, read current active work, cares, system health, service state, storage, and the download queue. Current tool facts outrank care history; a stale care is a recheck item, not a present-tense fact. Then give Ari one compact household summary; do not ask him to choose a status slice.",
+        retryMessage: "Before answering, read current active work, cares, system health, service state, storage, notifications, and the download queue. Current tool facts outrank care history; a stale care is a recheck item, not a present-tense fact. Then give Ari one compact household summary; do not ask him to choose a status slice.",
         requireSuccessfulResults: true,
         validateRequiredToolResult: (name, result) => {
             const validation = successfulCurrentResult(name, result);
@@ -106,7 +140,163 @@ function sanctuaryFullVisibilityRequiredToolCalls(request, advertisedToolNames)
                 completed.add(name);
             return validation.valid;
         },
-        validateTerminalAnswer: (answer) => unsupportedCurrentClaim(answer, queueUnavailable),
+        validateTerminalAnswer: (answer) => unsupportedCurrentClaim(answer, queueUnavailable, authorizedDockerClaims()),
         emptyResponseFallback: () => REQUIRED_TOOL_NAMES.every((name) => completed.has(name)) ? sanctuaryFullVisibilityEmptyResponse(request) : undefined,
     };
 }
+const SAFE_LABEL = "Docker image disk utilization";
+const INCONCLUSIVE_RISK = "Docker image disk utilization verification is inconclusive.";
+const ACTIVE_RISK = "A fresh Unraid notification reports high Docker image disk utilization.";
+function qualifyingDockerCare(care, now) {
+    if ((0, cares_1.projectCareEvidence)(care, now) === care)
+        return undefined;
+    const binding = care.incidentBindings?.find(cares_1.isManagedDockerCareIncidentBinding);
+    return binding ? {
+        id: care.id, updatedAt: care.updatedAt, currentRisk: care.currentRisk, nextCheckAt: care.nextCheckAt, salience: care.salience, steward: care.steward, binding: { ...binding },
+        hasOtherUnresolvedBindings: care.incidentBindings.some((candidate) => candidate !== binding && !candidate.resolvedAt),
+    } : undefined;
+}
+function canonicalNotification(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const notification = value;
+    return typeof notification.id === "string"
+        && typeof notification.createdAt === "string"
+        && Number.isFinite(Date.parse(notification.createdAt))
+        && new Date(notification.createdAt).toISOString() === notification.createdAt
+        && typeof notification.title === "string"
+        && typeof notification.summary === "string"
+        && typeof notification.severity === "string"
+        && typeof notification.degraded === "boolean"
+        ? notification
+        : undefined;
+}
+function notificationRevision(notification) {
+    return (0, node_crypto_1.createHash)("sha256").update(JSON.stringify({
+        id: notification.id,
+        createdAt: notification.createdAt,
+        severity: notification.severity,
+        title: notification.title,
+        summary: notification.summary,
+        degraded: notification.degraded,
+    })).digest("hex");
+}
+function dockerObservation(result, care) {
+    try {
+        const parsed = JSON.parse(result);
+        const data = parsed?.ok === true && parsed.data && typeof parsed.data === "object" && !Array.isArray(parsed.data) ? parsed.data : undefined;
+        if (!data || data.truncated !== false || !Array.isArray(data.unacknowledged))
+            return { outcome: "inconclusive" };
+        const boundary = Math.max(Date.parse(care.updatedAt), Date.parse(care.nextCheckAt));
+        const related = data.unacknowledged.map(canonicalNotification).filter((item) => !!item).filter((item) => {
+            const text = `${item.title} ${item.summary}`;
+            return item.degraded === false && Date.parse(String(item.createdAt)) > boundary && /docker/iu.test(text) && /image/iu.test(text) && /(?:disk|utilization)/iu.test(text);
+        });
+        if (related.length !== 1)
+            return { outcome: "inconclusive" };
+        const notification = related[0];
+        const text = `${notification.title} ${notification.summary}`;
+        const revision = notificationRevision(notification);
+        if (/\b(?:recover(?:ed|y)?|resolved|normal|healthy|cleared)\b/iu.test(text))
+            return { outcome: "fresh_recovered", revision };
+        if (/\b(?:critical|warning|error|full|high|9[0-9]%|100%)\b/iu.test(`${notification.severity} ${text}`)) {
+            return { outcome: "fresh_active", revision, risk: ACTIVE_RISK };
+        }
+        return { outcome: "inconclusive" };
+    }
+    catch {
+        return { outcome: "inconclusive" };
+    }
+}
+function mutationFor(care, observation, now) {
+    const common = {
+        id: care.id,
+        source: care.binding.source,
+        incidentKey: care.binding.incidentKey,
+        expectedUpdatedAt: care.updatedAt,
+        label: SAFE_LABEL,
+        why: observation.outcome === "inconclusive" ? "Current Unraid notification evidence was inconclusive." : "Current Unraid notification evidence was checked.",
+    };
+    if (observation.outcome === "fresh_recovered") {
+        const unresolvedContextRemains = care.hasOtherUnresolvedBindings;
+        return {
+            ...common,
+            action: "resolve_incident",
+            currentRisk: unresolvedContextRemains ? cares_1.CARE_INCIDENT_RECOVERY_REVIEW_RISK : "",
+            nextCheckAt: unresolvedContextRemains ? new Date(now + 15 * 60_000).toISOString() : "",
+        };
+    }
+    return {
+        ...common,
+        action: "upsert_incident",
+        kind: "system",
+        status: observation.outcome === "fresh_active" ? "active" : "watching",
+        salience: care.salience,
+        stewardship: care.steward,
+        classifiedRevision: observation.outcome === "fresh_active" ? observation.revision : care.binding.classifiedRevision,
+        currentRisk: observation.outcome === "fresh_active" ? observation.risk : INCONCLUSIVE_RISK,
+        nextCheckAt: new Date(now + 15 * 60_000).toISOString(),
+    };
+}
+function exactMutation(expected, actual) {
+    return Object.keys(expected).length === Object.keys(actual).length
+        && Object.entries(expected).every(([key, value]) => actual[key] === value);
+}
+function sanctuaryStaleDockerCareRequiredToolCalls(activeCares, now, _advertisedToolNames) {
+    const cares = activeCares.map((care) => qualifyingDockerCare(care, now)).filter((care) => !!care);
+    if (cares.length === 0)
+        return undefined;
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_stale_docker_care_verification_required", message: "stale Docker Care requires current notification verification", meta: { careCount: cares.length } });
+    let verifierComplete = false;
+    let mutations = [];
+    const completed = new Set();
+    return {
+        names: ["unraid_get_notifications"],
+        get retryMessage() {
+            return mutations.length === 0
+                ? "Recheck the stale Docker image disk Care from current notifications, then apply every exact evidence-bounded Care update before answering."
+                : `Apply these exact evidence-bounded care_manage arguments before answering: ${JSON.stringify(mutations)}.`;
+        },
+        requireSuccessfulResults: true,
+        validateRequiredToolResult: (name, result, args) => {
+            if (name === "unraid_get_notifications")
+                return Buffer.byteLength(result, "utf8") <= 1_000_000;
+            if (name !== "care_manage")
+                return false;
+            const expected = mutations.find((candidate) => exactMutation(candidate, args));
+            if (!expected)
+                return false;
+            try {
+                const care = JSON.parse(result);
+                const binding = care.incidentBindings?.find((candidate) => candidate.source === expected.source && candidate.incidentKey === expected.incidentKey);
+                const resolved = expected.action === "resolve_incident" ? !!binding?.resolvedAt : binding?.classifiedRevision === expected.classifiedRevision;
+                const updatedUnderCas = typeof care.updatedAt === "string" && Date.parse(care.updatedAt) > Date.parse(expected.expectedUpdatedAt);
+                const wholeCareResolutionValid = expected.action !== "resolve_incident" || expected.currentRisk !== "" || care.incidentBindings?.some((candidate) => !candidate.resolvedAt) || care.status === "resolved";
+                if (care.id !== expected.id || care.label !== SAFE_LABEL || care.why !== expected.why || care.currentRisk !== (expected.currentRisk || null) || care.nextCheckAt !== (expected.nextCheckAt || null) || (expected.status && care.status !== expected.status) || !resolved || !updatedUnderCas || !wholeCareResolutionValid)
+                    return false;
+                completed.add(care.id);
+                return completed.size === mutations.length;
+            }
+            catch {
+                return false;
+            }
+        },
+        validateToolCallBeforeDispatch: (name, args) => {
+            if (name !== "care_manage")
+                return undefined;
+            if (!verifierComplete)
+                return "Read current Unraid notifications before mutating stale Docker Care.";
+            return mutations.some((candidate) => exactMutation(candidate, args)) ? undefined : `Only these exact evidence-bounded stale Docker Care mutations are authorized in this turn: ${JSON.stringify(mutations)}.`;
+        },
+        requiredToolCallsAfterResult: (name, _args, result) => {
+            if (name !== "unraid_get_notifications")
+                return [];
+            mutations = cares.map((care) => mutationFor(care, dockerObservation(result, care), now));
+            verifierComplete = true;
+            (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_stale_docker_care_verification_completed", message: "current notification verification produced bounded Care outcomes", meta: { careCount: cares.length, mutationCount: mutations.length } });
+            return ["care_manage"];
+        },
+        expectedMutations: () => mutations.map((mutation) => ({ ...mutation })),
+        currentRiskClaims: () => mutations.filter((mutation) => mutation.currentRisk === ACTIVE_RISK).map((mutation) => mutation.currentRisk),
+    };
+}

package/dist/senses/sanctuary-storage-optimization-contract.js

@@ -11,13 +11,12 @@ function normalizedRequest(request) {
         .replace(/[^a-z0-9']+/gu, " ")
         .trim();
 }
-function sanctuaryStorageOptimizationRequiredToolCalls(request, advertisedToolNames) {
+function sanctuaryStorageOptimizationRequiredToolCalls(request, _advertisedToolNames) {
     const normalized = normalizedRequest(request);
     const hasStorageSubject = /\b(?:space|storage)\b/u.test(normalized);
     const hasUsageDiagnosis = /\b(?:using|taking up|find what|diagnos(?:e|is))\b/u.test(normalized);
     const hasShrinkIntent = /\b(?:make it smaller|shrink|reclaim|free up|reduce|optimi[sz])\b/u.test(normalized);
-    const advertised = new Set(advertisedToolNames);
-    if (!hasStorageSubject || !hasUsageDiagnosis || !hasShrinkIntent || !REQUIRED_TOOL_NAMES.every((name) => advertised.has(name)))
+    if (!hasStorageSubject || !hasUsageDiagnosis || !hasShrinkIntent)
         return undefined;
     const names = [...REQUIRED_TOOL_NAMES];
     (0, runtime_1.emitNervesEvent)({

package/dist/senses/telegram.js

@@ -1078,23 +1078,46 @@ function createTelegramSenseApp(options) {
                 authorizeTool: async (name, args) => (await options.resolveRelationshipAuthorization(relationshipCoordinates)).authorizeTool(name, args),
             };
         };
-        return async ({ runAgentOptions }) => {
+        return async ({ runAgentOptions, activeCares = [], careEvidenceNow = Date.now() }) => {
             const relationshipAuthorization = await resolveLiveRelationshipAuthorization();
-            const storageOptimization = options.agentName === "sanctuary" && relationshipAuthorization.profileId === "sanctuary-owner"
+            const isSanctuaryOwner = options.agentName === "sanctuary" && relationshipAuthorization.profileId === "sanctuary-owner";
+            const storageOptimization = isSanctuaryOwner
                 ? (0, sanctuary_storage_optimization_contract_1.sanctuaryStorageOptimizationRequiredToolCalls)(input.userMessage, relationshipAuthorization.advertisedToolNames)
                 : undefined;
-            const fullVisibility = options.agentName === "sanctuary" && relationshipAuthorization.profileId === "sanctuary-owner" && !storageOptimization
-                ? (0, sanctuary_full_visibility_contract_1.sanctuaryFullVisibilityRequiredToolCalls)(input.userMessage, relationshipAuthorization.advertisedToolNames)
+            const staleDockerCare = isSanctuaryOwner
+                ? (0, sanctuary_full_visibility_contract_1.sanctuaryStaleDockerCareRequiredToolCalls)(activeCares, careEvidenceNow, relationshipAuthorization.advertisedToolNames)
+                : undefined;
+            const fullVisibility = isSanctuaryOwner
+                ? (0, sanctuary_full_visibility_contract_1.sanctuaryFullVisibilityRequiredToolCalls)(input.userMessage, relationshipAuthorization.advertisedToolNames, () => staleDockerCare?.currentRiskClaims() ?? [])
                 : undefined;
             if (input.fullVisibilityProgress && fullVisibility)
                 input.fullVisibilityProgress.fallback = fullVisibility.emptyResponseFallback;
-            const requiredToolCalls = storageOptimization ?? (fullVisibility ? {
-                names: fullVisibility.names,
-                retryMessage: fullVisibility.retryMessage,
-                requireSuccessfulResults: fullVisibility.requireSuccessfulResults,
-                validateRequiredToolResult: fullVisibility.validateRequiredToolResult,
-                validateTerminalAnswer: fullVisibility.validateTerminalAnswer,
-            } : undefined);
+            const contracts = [storageOptimization, fullVisibility, staleDockerCare].filter(Boolean);
+            const ownedNames = contracts.map((contract) => new Set(contract.names));
+            const requiredToolCalls = contracts.length === 0 ? undefined : {
+                names: [...new Set(contracts.flatMap((contract) => [...contract.names]))],
+                get retryMessage() { return contracts.map((contract) => contract.retryMessage).join(" "); },
+                requireSuccessfulResults: true,
+                validateRequiredToolResult: (name, result, args) => contracts.every((contract, index) => {
+                    if (!ownedNames[index].has(name))
+                        return true;
+                    return contract.validateRequiredToolResult?.(name, result, args) ?? true;
+                }),
+                validateToolCallBeforeDispatch: (name, args) => contracts.map((contract) => contract.validateToolCallBeforeDispatch?.(name, args)).find((rejection) => rejection !== undefined),
+                requiredToolCallsAfterResult: (name, args, result) => {
+                    const added = new Set();
+                    contracts.forEach((contract, index) => {
+                        if (!ownedNames[index].has(name) || !contract.requiredToolCallsAfterResult)
+                            return;
+                        for (const requiredName of contract.requiredToolCallsAfterResult(name, args, result)) {
+                            ownedNames[index].add(requiredName);
+                            added.add(requiredName);
+                        }
+                    });
+                    return [...added];
+                },
+                validateTerminalAnswer: (answer) => contracts.map((contract) => contract.validateTerminalAnswer?.(answer)).find((rejection) => rejection !== undefined),
+            };
             return {
                 ...runAgentOptions,
                 ...(requiredToolCalls ? { requiredToolCalls } : {}),

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.767",
+  "version": "0.1.0-alpha.769",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.767",
+      "version": "0.1.0-alpha.769",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.767",
+  "version": "0.1.0-alpha.769",
   "engines": {
     "node": ">=22"
   },