@ouro.bot/cli 0.1.0-alpha.77 → 0.1.0-alpha.770

package/dist/senses/sanctuary-runtime.js

@@ -0,0 +1,287 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runWithSanctuaryToolReceiptCollection = runWithSanctuaryToolReceiptCollection;
+exports.loadSanctuarySabApiKey = loadSanctuarySabApiKey;
+exports.createSanctuaryToolContext = createSanctuaryToolContext;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const node_async_hooks_1 = require("node:async_hooks");
+const identity_1 = require("../heart/identity");
+const runtime_credentials_1 = require("../heart/runtime-credentials");
+const unraid_restart_1 = require("../repertoire/unraid-restart");
+const steward_policy_1 = require("../heart/steward-policy");
+const unraid_client_1 = require("../repertoire/unraid-client");
+const tools_unraid_1 = require("../repertoire/tools-unraid");
+const runtime_1 = require("../nerves/runtime");
+const sanctuary_acceptance_marker_1 = require("../heart/daemon/sanctuary-acceptance-marker");
+const sanctuary_grounding_1 = require("./sanctuary-grounding");
+const sanctuary_health_1 = require("./sanctuary-health");
+const sanctuary_sab_1 = require("./sanctuary-sab");
+const sanctuary_media_optimization_1 = require("./sanctuary-media-optimization");
+const sanctuaryToolReceipts = new node_async_hooks_1.AsyncLocalStorage();
+const sanctuaryToolGroundings = new node_async_hooks_1.AsyncLocalStorage();
+const acceptanceLedgerTails = new Map();
+async function runWithSanctuaryToolReceiptCollection(operation, observer) {
+    const digests = observer?.toolResultDigests ?? [];
+    const groundings = observer?.toolGroundings ?? [];
+    const result = await sanctuaryToolReceipts.run(digests, () => sanctuaryToolGroundings.run(groundings, operation));
+    return { result, toolResultDigests: [...digests], ...(groundings.length > 0 ? { toolGroundings: structuredClone(groundings) } : {}) };
+}
+function collectToolResult(result, toolName) {
+    const digest = (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(result)).digest("hex");
+    sanctuaryToolReceipts.getStore()?.push(digest);
+    let facts = null;
+    try {
+        facts = toolName ? (0, sanctuary_grounding_1.projectSanctuaryGrounding)(toolName, result) : null;
+    }
+    catch { /* validated tool adapters own malformed-result failure */ }
+    if (!facts || (toolName !== "unraid_get_system" && toolName !== "unraid_get_storage"))
+        return { resultDigest: digest };
+    const groundingDigest = (0, sanctuary_grounding_1.sanctuaryGroundingDigest)(facts);
+    const envelope = result;
+    const sourceIdentityDigest = envelope?.data?.sourceIdentityDigest;
+    if (typeof sourceIdentityDigest !== "string" || !/^[0-9a-f]{64}$/u.test(sourceIdentityDigest))
+        throw new Error("Sanctuary grounding source identity is invalid");
+    const verifiedSourceIdentityDigest = sourceIdentityDigest;
+    const observedAt = new Date().toISOString();
+    sanctuaryToolGroundings.getStore()?.push({ toolName, resultDigest: digest, groundingDigest, sourceIdentityDigest: verifiedSourceIdentityDigest, observedAt, facts });
+    return { resultDigest: digest, groundingDigest, sourceIdentityDigest: verifiedSourceIdentityDigest, observedAt };
+}
+function machineConfig(agentName) {
+    const result = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agentName);
+    if (!result.ok)
+        throw new Error(`Sanctuary machine runtime config is ${result.reason}`);
+    return result.config;
+}
+function required(config, field) {
+    const value = config[field];
+    if (typeof value !== "string" || value.trim().length === 0)
+        throw new Error(`Sanctuary ${field} is missing`);
+    return value.trim();
+}
+async function loadSanctuarySabApiKey(agentName) {
+    return required(machineConfig(agentName), "sabnzbdApiKey");
+}
+function requiredObject(config, field) {
+    const value = config[field];
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`Sanctuary ${field} is missing`);
+    return value;
+}
+function requiredPair(config, field) {
+    const values = required(config, field).split(",").map((value) => value.trim());
+    if (values.length !== 2 || new Set(values).size !== 2 || values.some((value) => value.length === 0))
+        throw new Error(`Sanctuary ${field} must contain exactly two unique IDs`);
+    return [values[0], values[1]];
+}
+function optionalJellyfin(config) {
+    if (config.jellyfin === undefined)
+        return {};
+    const jellyfin = requiredObject(config, "jellyfin");
+    return {
+        jellyfinUserId: required(jellyfin, "userId"),
+        jellyfinAccessToken: required(jellyfin, "accessToken"),
+        jellyfinFolderIds: requiredPair(jellyfin, "folderIds"),
+    };
+}
+function persistAttempt(filePath, attempt) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const temporary = `${filePath}.tmp-${process.pid}-${(0, node_crypto_1.randomUUID)()}`;
+    fs.writeFileSync(temporary, `${JSON.stringify(attempt)}\n`, { mode: 0o600 });
+    fs.renameSync(temporary, filePath);
+}
+async function appendAcceptanceAttempt(agentRoot, attempt) {
+    if (!attempt.scenarioHandleDigest)
+        return;
+    const filePath = path.join(agentRoot, "state", "acceptance", "restart-attempts.ndjson");
+    const previous = acceptanceLedgerTails.get(filePath) ?? Promise.resolve();
+    const current = previous.catch(() => undefined).then(() => {
+        fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+        let existing = [];
+        try {
+            if (fs.statSync(filePath).size > 4 * 1024 * 1024)
+                throw new Error("restart ledger exceeds its bound");
+            existing = fs.readFileSync(filePath, "utf8").split("\n").filter(Boolean);
+            if (existing.length > 500 || existing.some((line) => Buffer.byteLength(line) > 8 * 1024))
+                throw new Error("restart ledger rows exceed their bound");
+            for (const line of existing) {
+                const value = JSON.parse(line);
+                if (!value || typeof value !== "object" || !value.container || typeof value.container.id !== "string" || !value.container.id || value.container.id.length > 128
+                    || typeof value.container.name !== "string" || !value.container.name || value.container.name.length > 128
+                    || !["attempt_not_started", "attempting", "succeeded", "attempted_or_indeterminate"].includes(String(value.state))
+                    || typeof value.observedAt !== "string" || !Number.isFinite(Date.parse(value.observedAt)) || new Date(Date.parse(value.observedAt)).toISOString() !== value.observedAt
+                    || !/^[0-9a-f]{64}$/u.test(String(value.actionDigest)) || !/^[0-9a-f]{64}$/u.test(String(value.argumentDigest))
+                    || !/^[0-9a-f]{64}$/u.test(String(value.scenarioHandleDigest)) || typeof value.approvalId !== "string" || !value.approvalId || value.approvalId.length > 128
+                    || typeof value.attemptId !== "string" || !value.attemptId || value.attemptId.length > 128 || typeof value.mutationAcknowledged !== "boolean"
+                    || (value.afterState !== null && (typeof value.afterState !== "string" || value.afterState.length > 64)))
+                    throw new Error("restart ledger row is invalid");
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw new Error("Sanctuary acceptance restart ledger is corrupt", { cause: error });
+        }
+        const entries = [...existing, JSON.stringify(attempt)].slice(-500);
+        const temporary = `${filePath}.tmp-${process.pid}-${(0, node_crypto_1.randomUUID)()}`;
+        fs.writeFileSync(temporary, `${entries.join("\n")}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        const handle = fs.openSync(temporary, "r");
+        try {
+            fs.fsyncSync(handle);
+        }
+        finally {
+            fs.closeSync(handle);
+        }
+        fs.renameSync(temporary, filePath);
+        fs.chmodSync(filePath, 0o600);
+        const directory = fs.openSync(path.dirname(filePath), "r");
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+    });
+    acceptanceLedgerTails.set(filePath, current);
+    try {
+        await current;
+    }
+    finally {
+        if (acceptanceLedgerTails.get(filePath) === current)
+            acceptanceLedgerTails.delete(filePath);
+    }
+}
+function createSanctuaryToolContext(agentName) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.sanctuary_runtime_create",
+        message: "creating typed Sanctuary tool context",
+        meta: { agentName },
+    });
+    const agentRoot = (0, identity_1.getAgentRoot)(agentName);
+    const initial = machineConfig(agentName);
+    const endpoint = required(initial, "unraidGraphqlUrl");
+    const readClient = new unraid_client_1.UnraidClient({ endpoint, apiKey: required(initial, "unraidReadApiKey") });
+    const reads = (0, tools_unraid_1.createUnraidReadTools)(readClient);
+    const sab = (0, sanctuary_sab_1.createSanctuarySabClient)({ loadApiKey: () => loadSanctuarySabApiKey(agentName) });
+    const mediaOptimization = (0, sanctuary_media_optimization_1.createSanctuaryMediaOptimizationClient)(optionalJellyfin(initial));
+    const acceptanceRead = (toolName, read) => async (...args) => {
+        try {
+            const result = await read(...args);
+            const receipt = collectToolResult(result, toolName);
+            const semantic = result && typeof result === "object" && "ok" in result ? result : null;
+            if (semantic?.ok === false) {
+                (0, runtime_1.emitNervesEvent)({ level: "error", component: "senses", event: "senses.sanctuary_read_receipt_error", message: "Sanctuary live read returned a semantic failure", meta: { toolName, success: false, semanticCode: typeof semantic.error?.code === "string" ? semantic.error.code : "unknown", ...receipt, ...(0, sanctuary_acceptance_marker_1.sanctuaryAcceptanceEventMeta)(agentName) } });
+            }
+            else {
+                (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_read_receipt", message: "Sanctuary live read completed", meta: { toolName, success: true, ...receipt, ...(0, sanctuary_acceptance_marker_1.sanctuaryAcceptanceEventMeta)(agentName) } });
+            }
+            return result;
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({ level: "error", component: "senses", event: "senses.sanctuary_read_receipt_error", message: "Sanctuary live read failed", meta: { toolName, success: false, category: error instanceof Error ? error.name : "unknown", ...(0, sanctuary_acceptance_marker_1.sanctuaryAcceptanceEventMeta)(agentName) } });
+            throw error;
+        }
+    };
+    const restart = (0, unraid_restart_1.createApprovedUnraidRestartExecutor)({
+        endpoint,
+        listContainers: reads.listContainers,
+        loadWriteApiKey: async () => required(machineConfig(agentName), "unraidWriteApiKey"),
+        persistAttempt: async (attempt) => {
+            persistAttempt(path.join(agentRoot, "state", "approvals", "unraid-restart-attempt.json"), attempt);
+            await appendAcceptanceAttempt(agentRoot, attempt);
+        },
+        acceptanceScenarioHandleDigest: () => (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)(agentName)?.scenarioHandleDigest,
+        acceptanceApproval: sanctuary_acceptance_marker_1.readSanctuaryAcceptanceApproval,
+        reserveRoutineAction: (input) => (0, steward_policy_1.consumeRoutineActionGrant)(agentRoot, input),
+        transitionRoutineAction: (input) => (0, steward_policy_1.transitionRoutineActionReceipt)(agentRoot, input),
+    });
+    return {
+        agentRoot,
+        sanctuary: {
+            listContainers: acceptanceRead("unraid_list_containers", reads.listContainers),
+            getContainerLogs: acceptanceRead("unraid_get_container_logs", reads.getContainerLogs),
+            getStorage: acceptanceRead("unraid_get_storage", reads.getStorage),
+            getDisks: acceptanceRead("unraid_get_disks", reads.getDisks),
+            getNotifications: acceptanceRead("unraid_get_notifications", reads.getNotifications),
+            getSystem: acceptanceRead("unraid_get_system", reads.getSystem),
+            checkServices: acceptanceRead("unraid_check_services", async () => {
+                const services = await Promise.all(sanctuary_health_1.SANCTUARY_PUBLIC_ENDPOINTS.map(async (url) => ({ name: new URL(url).hostname.split(".")[0], ...await (0, sanctuary_health_1.probeSanctuaryEndpoint)(url) })));
+                return { ok: true, data: { observedAt: new Date().toISOString(), services, degraded: services.some((service) => !service.ok) } };
+            }),
+            getDownloadQueue: acceptanceRead("sanctuary_get_download_queue", async () => {
+                try {
+                    return await sab.readQueue();
+                }
+                catch (error) {
+                    const code = (0, sanctuary_sab_1.sanctuarySabReadUnavailableCode)(error);
+                    if (code)
+                        return { ok: false, error: { code }, observedAt: new Date().toISOString() };
+                    throw error;
+                }
+            }),
+            getMediaOptimization: acceptanceRead("sanctuary_get_media_optimization", mediaOptimization.read),
+            resumeDownloadQueue: async () => {
+                try {
+                    const result = await sab.resumeQueue();
+                    collectToolResult(result);
+                    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_download_resume_receipt", message: "Sanctuary download queue resume completed", meta: { changed: result.changed, verified: result.verified, receiptDigest: result.receiptDigest } });
+                    return { ok: true, data: result };
+                }
+                catch (error) {
+                    (0, runtime_1.emitNervesEvent)({ level: "error", component: "senses", event: "senses.sanctuary_download_resume_error", message: "Sanctuary download queue resume failed", meta: { category: error instanceof Error ? error.name : "unknown" } });
+                    throw error;
+                }
+            },
+            restartContainer: async (args, execution) => {
+                const result = execution ? await restart(args, execution) : await restart(args);
+                collectToolResult(result);
+                return result;
+            },
+            recoverRoutineActions: () => (0, steward_policy_1.recoverRoutineActionReceipts)(agentRoot, {
+                observeTarget: async (target) => {
+                    const observed = await reads.listContainers();
+                    if (!observed.ok)
+                        throw new Error(observed.error.message);
+                    const matches = observed.data.containers.filter((container) => container.id === target.id && container.name === target.name);
+                    if (matches.length !== 1)
+                        return { ...target, state: "unknown" };
+                    return { id: matches[0].id, name: matches[0].name, state: matches[0].state };
+                },
+            }),
+        },
+    };
+}

package/dist/senses/sanctuary-sab.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANCTUARY_SAB_CREDENTIAL_UNAVAILABLE = void 0;
+exports.sanctuarySabReadUnavailableCode = sanctuarySabReadUnavailableCode;
+exports.createSanctuarySabClient = createSanctuarySabClient;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+const BASE_URL = "http://127.0.0.1:8090/api";
+exports.SANCTUARY_SAB_CREDENTIAL_UNAVAILABLE = "SAB queue verification credential is unavailable";
+function sanctuarySabReadUnavailableCode(error) {
+    if (!(error instanceof Error))
+        return undefined;
+    if (error.message === exports.SANCTUARY_SAB_CREDENTIAL_UNAVAILABLE)
+        return "credential_unavailable";
+    if (error.message === "SAB queue request failed")
+        return "request_unavailable";
+    if (error.message === "SAB queue response is malformed")
+        return "malformed_response";
+    return undefined;
+}
+function queuedJobs(value) {
+    const parsed = typeof value === "string" && /^\d{1,7}$/u.test(value) ? Number(value) : value;
+    if (!Number.isSafeInteger(parsed) || Number(parsed) < 0 || Number(parsed) > 1_000_000)
+        throw new Error("SAB queue response is malformed");
+    return Number(parsed);
+}
+function createSanctuarySabClient(options) {
+    const fetchImpl = options.fetch ?? fetch;
+    const request = async (mode) => {
+        let apiKey;
+        try {
+            apiKey = (await options.loadApiKey()).trim();
+        }
+        catch {
+            throw new Error(exports.SANCTUARY_SAB_CREDENTIAL_UNAVAILABLE);
+        }
+        if (!apiKey)
+            throw new Error(exports.SANCTUARY_SAB_CREDENTIAL_UNAVAILABLE);
+        let response;
+        try {
+            response = await fetchImpl(`${BASE_URL}?mode=${mode}${mode === "queue" ? "&output=json" : ""}&apikey=${encodeURIComponent(apiKey)}`, { signal: AbortSignal.timeout(15_000) });
+        }
+        catch {
+            throw new Error("SAB queue request failed");
+        }
+        if (!response.ok)
+            throw new Error("SAB queue request failed");
+        return response;
+    };
+    const readQueue = async () => {
+        const response = await request("queue");
+        const body = await response.json();
+        if (!body || typeof body !== "object" || Array.isArray(body))
+            throw new Error("SAB queue response is malformed");
+        const queue = body.queue;
+        if (!queue || typeof queue !== "object" || Array.isArray(queue))
+            throw new Error("SAB queue response is malformed");
+        const fields = queue;
+        if (typeof fields.paused !== "boolean" || (fields.status !== undefined && (typeof fields.status !== "string" || Buffer.byteLength(fields.status) > 64)))
+            throw new Error("SAB queue response is malformed");
+        const status = typeof fields.status === "string" ? fields.status : "unknown";
+        const jobs = fields.noofslots === undefined ? 0 : queuedJobs(fields.noofslots);
+        const observedAt = options.now?.() ?? new Date().toISOString();
+        const stateDigest = (0, node_crypto_1.createHash)("sha256").update(JSON.stringify({ paused: fields.paused, status, queuedJobs: jobs })).digest("hex");
+        return { paused: fields.paused, status, queuedJobs: jobs, observedAt, stateDigest };
+    };
+    return {
+        readQueue,
+        async resumeQueue() {
+            const before = await readQueue();
+            if (!before.paused) {
+                const receiptDigest = (0, node_crypto_1.createHash)("sha256").update(`sabnzbd.resume\0${before.stateDigest}\0${before.stateDigest}`).digest("hex");
+                return { changed: false, before, after: before, verified: true, receiptDigest };
+            }
+            const response = await request("resume");
+            await response.body?.cancel().catch(() => undefined);
+            const after = await readQueue();
+            if (after.paused)
+                throw new Error("SAB queue resume could not be verified");
+            const receiptDigest = (0, node_crypto_1.createHash)("sha256").update(`sabnzbd.resume\0${before.stateDigest}\0${after.stateDigest}`).digest("hex");
+            return { changed: true, before, after, verified: true, receiptDigest };
+        },
+    };
+}
+(0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_sab_loaded", message: "typed Sanctuary SAB queue client loaded", meta: { operations: 2 } });

package/dist/senses/sanctuary-storage-optimization-contract.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanctuaryStorageOptimizationRequiredToolCalls = sanctuaryStorageOptimizationRequiredToolCalls;
+const runtime_1 = require("../nerves/runtime");
+const REQUIRED_TOOL_NAMES = ["unraid_get_storage", "sanctuary_get_media_optimization"];
+function normalizedRequest(request) {
+    return request
+        .normalize("NFKC")
+        .toLowerCase()
+        .replace(/[‘’]/gu, "'")
+        .replace(/[^a-z0-9']+/gu, " ")
+        .trim();
+}
+function sanctuaryStorageOptimizationRequiredToolCalls(request, _advertisedToolNames) {
+    const normalized = normalizedRequest(request);
+    const hasStorageSubject = /\b(?:space|storage)\b/u.test(normalized);
+    const hasUsageDiagnosis = /\b(?:using|taking up|find what|diagnos(?:e|is))\b/u.test(normalized);
+    const hasShrinkIntent = /\b(?:make it smaller|shrink|reclaim|free up|reduce|optimi[sz])\b/u.test(normalized);
+    if (!hasStorageSubject || !hasUsageDiagnosis || !hasShrinkIntent)
+        return undefined;
+    const names = [...REQUIRED_TOOL_NAMES];
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.sanctuary_storage_optimization_obligation",
+        message: "storage diagnosis and optimization intent requires both safe evidence reads",
+        meta: { requiredToolNames: names },
+    });
+    return {
+        names,
+        retryMessage: "Run both safe reads now, identify the largest measured evidence, report Unmanic and Jellyfin findings, and propose a sample encode without inventing future savings. Do not ask permission or send Ari to a shell or QDirStat while these typed reads are available.",
+    };
+}