@ouro.bot/cli 0.1.0-alpha.810 → 0.1.0-alpha.811

package/dist/senses/cli.js

@@ -951,7 +951,9 @@ async function main(agentName, options) {
     // Fail fast if provider is misconfigured (triggers human-readable error + exit)
     (0, core_1.getProvider)("human");
     // Resolve context kernel (identity + channel) for CLI
-    const friendsPath = path.join((0, identity_1.getAgentRoot)(), "friends");
+    const currentAgentName = (0, identity_1.getAgentName)();
+    const owner = { agentName: currentAgentName, agentRoot: (0, identity_1.getAgentRoot)(currentAgentName) };
+    const friendsPath = path.join(owner.agentRoot, "friends");
     const friendStore = new friends_1.FileFriendStore(friendsPath);
     const username = os.userInfo().username;
     const localExternalId = username;
@@ -975,13 +977,11 @@ async function main(agentName, options) {
     let existing = null;
     let sessionState;
     let sessionEvents = [];
-    const mcpManager = await (0, mcp_manager_1.getSharedMcpManager)() ?? undefined;
     const sessionMessages = [
         { role: "system", content: (0, prompt_1.flattenSystemPrompt)(await (0, prompt_1.buildSystem)("cli", {}, resolvedContext)) },
     ];
     // Per-turn pipeline input: CLI capabilities and pending dir
     const cliCapabilities = (0, friends_1.getChannelCapabilities)("cli");
-    const currentAgentName = (0, identity_1.getAgentName)();
     const pendingDir = (0, pending_1.getPendingDir)(currentAgentName, friendId, "cli", "session");
     const summarize = (0, core_1.createSummarize)("human");
     const cliFailoverState = { pending: null };
@@ -1077,12 +1077,14 @@ async function main(agentName, options) {
                 enforceTrustGate: trust_gate_1.enforceTrustGate,
                 drainPending: pending_1.drainPending,
                 drainDeferredReturns: (deferredFriendId) => (0, pending_1.drainDeferredReturns)(currentAgentName, deferredFriendId),
-                runAgent: (msgs, cb, channel, sig, opts) => (0, core_1.runAgent)(msgs, cb, channel, sig, {
+                runAgent: async (msgs, cb, channel, sig, opts) => (0, core_1.runAgent)(msgs, cb, channel, sig, {
                     ...opts,
+                    mcpManager: opts?.hardDisableTools ? undefined : await (0, mcp_manager_1.getSharedMcpManager)(owner) ?? undefined,
                     toolContext: {
                         /* v8 ignore next -- default no-op signin; pipeline provides the real one @preserve */
                         signin: async () => undefined,
                         ...opts?.toolContext,
+                        ...owner,
                         summarize,
                     },
                 }),
@@ -1102,7 +1104,6 @@ async function main(agentName, options) {
                 runAgentOptions: {
                     toolChoiceRequired: (0, commands_1.getToolChoiceRequired)(),
                     traceId: (0, nerves_1.createTraceId)(),
-                    mcpManager,
                     toolContext,
                 },
                 failoverState,

package/dist/senses/private-runtime.js

@@ -1157,7 +1157,8 @@ async function runPrivateRuntimeTurn(options) {
             const innerCapabilities = (0, friends_1.getChannelCapabilities)("inner");
             const selfFriend = createSelfFriend(agentName);
             const selfContext = { friend: selfFriend, channel: innerCapabilities };
-            const mcpManager = await (0, mcp_manager_1.getSharedMcpManager)() ?? undefined;
+            const mcpOwner = { agentName, agentRoot: (0, identity_1.getAgentRoot)(agentName) };
+            const mcpManager = await (0, mcp_manager_1.getSharedMcpManager)(mcpOwner) ?? undefined;
             const relationshipAwaitCoordinatesValue = parsedAwait ? relationshipAwaitCoordinates(parsedAwait) : null;
             const relationshipAwait = relationshipAwaitCoordinatesValue
                 ? await (async () => {
@@ -1301,11 +1302,15 @@ async function runPrivateRuntimeTurn(options) {
             }
             const externalEventExcludedTools = new Set(["rest", "settle", "speak"]);
             const externalEventToolsResolved = options?.externalEvent
-                ? (0, tools_1.getSanctuaryRelationshipTools)(externalEventRelationship.relationshipAuthorization.advertisedToolNames)
+                ? (0, tools_1.getToolsForChannel)(innerCapabilities, undefined, undefined, undefined, undefined, undefined, {
+                    agentName, relationshipAuthorization: externalEventRelationship.relationshipAuthorization,
+                })
                     .filter((tool) => !externalEventExcludedTools.has(tool.function.name))
                 : undefined;
             const relationshipAwaitToolsResolved = relationshipAwait
-                ? (0, tools_1.getSanctuaryRelationshipTools)(relationshipAwait.relationshipAuthorization.advertisedToolNames)
+                ? (0, tools_1.getToolsForChannel)(innerCapabilities, undefined, undefined, undefined, undefined, undefined, {
+                    agentName, relationshipAuthorization: relationshipAwait.relationshipAuthorization,
+                })
                 : undefined;
             const effectiveHabitSession = options?.noSend === true
                 ? reduceHabitSessionToNoSend(options.habitSession)
@@ -1429,6 +1434,7 @@ async function runPrivateRuntimeTurn(options) {
                             } : {}),
                             ...(options?.noSend ? { noSend: true } : {}),
                             ...(effectiveHabitSession ? { habitSession: effectiveHabitSession } : {}),
+                            ...mcpOwner,
                         },
                         ...(effectiveHabitSession ? { habitSession: effectiveHabitSession } : {}),
                     },

package/dist/senses/shared-turn.js

@@ -66,9 +66,9 @@ const OUTWARD_DELIVERY_TOOL_ACKS = new Map([
     ["settle", "(delivered)"],
     ["speak", "(spoken)"],
 ]);
-async function releaseRuntimeMcpServersAfterTurn() {
+async function releaseRuntimeMcpServersAfterTurn(owner) {
     const manager = await Promise.resolve().then(() => __importStar(require("../repertoire/mcp-manager")));
-    await manager.releaseRuntimeMcpServers();
+    await manager.releaseRuntimeMcpServers(owner);
 }
 /**
  * Strip MiniMax-style `<think>...</think>` reasoning blocks from a response
@@ -323,19 +323,21 @@ function getSenseSessionPath(agentName, friendId, channel, sessionKey, agentRoot
  */
 async function runSenseTurn(options) {
     return (0, turn_execution_lease_1.withTurnExecutionLease)(async () => {
-        (0, identity_1.setAgentName)(options.agentName);
+        const owner = Object.freeze({ agentName: options.agentName, agentRoot: (0, identity_1.getAgentRoot)(options.agentName) });
+        (0, identity_1.setAgentName)(owner.agentName);
         try {
-            return await runSenseTurnExclusive(options);
+            return await runSenseTurnExclusive(options, owner);
         }
         finally {
             if (options.runtimeMcpServers && !options.disableTools) {
-                await releaseRuntimeMcpServersAfterTurn();
+                await releaseRuntimeMcpServersAfterTurn(owner);
             }
         }
     });
 }
-async function runSenseTurnExclusive(options) {
-    const { agentName, channel, sessionKey, friendId, userMessage } = options;
+async function runSenseTurnExclusive(options, owner) {
+    const { channel, sessionKey, friendId, userMessage } = options;
+    const { agentName, agentRoot } = owner;
     (0, runtime_1.emitNervesEvent)({
         component: "senses",
         event: "senses.shared_turn_start",
@@ -343,7 +345,6 @@ async function runSenseTurnExclusive(options) {
         meta: { agentName, channel, sessionKey, friendId },
     });
     // Resolve context
-    const agentRoot = (0, identity_1.getAgentRoot)(agentName);
     const friendsPath = path.join(agentRoot, "friends");
     const friendStore = new friends_1.FileFriendStore(friendsPath);
     const capabilities = (0, friends_1.getChannelCapabilities)(channel);
@@ -386,7 +387,7 @@ async function runSenseTurnExclusive(options) {
     // Runtime MCP servers (e.g. Workbench's ouro_workbench) are passed per-turn for THIS agent only.
     const mcpManager = options.disableTools
         ? undefined
-        : await (0, mcp_manager_1.getSharedMcpManager)(options.runtimeMcpServers ? { runtimeServers: options.runtimeMcpServers } : undefined) ?? undefined;
+        : await (0, mcp_manager_1.getSharedMcpManager)({ ...owner, runtimeServers: options.runtimeMcpServers }) ?? undefined;
     // Session path and loading
     const ephemeralRoot = options.disablePersistence
         ? fs.mkdtempSync(path.join(os.tmpdir(), "ouro-observe-only-"))
@@ -576,6 +577,8 @@ async function runSenseTurnExclusive(options) {
                     toolContext: {
                         signin: async () => undefined,
                         ...(options.toolContext ? options.toolContext : {}),
+                        agentName,
+                        agentRoot,
                         currentUserMessage: userMessage,
                     },
                 },

package/dist/senses/teams.js

@@ -643,6 +643,8 @@ function handleTeamsSlashCommand(text, registry, friendId, conversationId, strea
 // Handle an incoming Teams message
 async function handleTeamsMessage(text, stream, conversationId, teamsContext, sendMessage, reactionOverrides, runtimeOverrides) {
     const turnKey = teamsTurnKey(conversationId);
+    const agentName = (0, identity_1.getAgentName)();
+    const owner = { agentName, agentRoot: (0, identity_1.getAgentRoot)(agentName) };
     // NOTE: Confirmation resolution is handled in the app.on("message") handler
     // BEFORE the conversation lock.  By the time we get here, any pending
     // confirmation has already been resolved and the reply consumed.
@@ -668,7 +670,7 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
     const traceId = (0, nerves_1.createTraceId)();
     const sessPath = (0, config_2.sessionPath)(friendId, "teams", conversationId);
     const teamsCapabilities = (0, friends_1.getChannelCapabilities)("teams");
-    const pendingDir = (0, pending_1.getPendingDir)((0, identity_1.getAgentName)(), friendId, "teams", conversationId);
+    const pendingDir = (0, pending_1.getPendingDir)(agentName, friendId, "teams", conversationId);
     const runWithLease = runtimeOverrides?._withSessionTurnLease ?? session_transaction_1.withSessionTurnLease;
     try {
         await runWithLease(sessPath, async (sessionTurnLease) => {
@@ -678,17 +680,17 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
             }
             await new Promise(r => setImmediate(r));
             // Build Teams-specific toolContext fields for injection into the pipeline
-            const teamsToolContext = teamsContext ? {
-                graphToken: teamsContext.graphToken,
-                adoToken: teamsContext.adoToken,
-                githubToken: teamsContext.githubToken,
-                signin: teamsContext.signin,
-                summarize: (0, core_1.createSummarize)("human"),
-                tenantId: teamsContext.tenantId,
-                botApi: teamsContext.botApi,
-            } : {};
+            const teamsToolContext = { ...owner, ...(teamsContext ? {
+                    graphToken: teamsContext.graphToken,
+                    adoToken: teamsContext.adoToken,
+                    githubToken: teamsContext.githubToken,
+                    signin: teamsContext.signin,
+                    summarize: (0, core_1.createSummarize)("human"),
+                    tenantId: teamsContext.tenantId,
+                    botApi: teamsContext.botApi,
+                } : {}) };
             let currentText = text;
-            const mcpManager = await (0, mcp_manager_1.getSharedMcpManager)() ?? undefined;
+            const mcpManager = await (0, mcp_manager_1.getSharedMcpManager)(owner) ?? undefined;
             while (true) {
                 let drainedSteeringFollowUps = [];
                 // Build runAgentOptions with Teams-specific fields
@@ -759,13 +761,14 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
                     hasExistingGroupWithFamily: false,
                     enforceTrustGate: trust_gate_1.enforceTrustGate,
                     drainPending: pending_1.drainPending,
-                    drainDeferredReturns: (deferredFriendId) => (0, pending_1.drainDeferredReturns)((0, identity_1.getAgentName)(), deferredFriendId),
+                    drainDeferredReturns: (deferredFriendId) => (0, pending_1.drainDeferredReturns)(agentName, deferredFriendId),
                     runAgent: (msgs, cb, channel, sig, opts) => (0, core_1.runAgent)(msgs, cb, channel, sig, {
                         ...opts,
                         toolContext: {
                             /* v8 ignore next -- default no-op signin; pipeline provides the real one @preserve */
                             signin: async () => undefined,
                             ...opts?.toolContext,
+                            ...owner,
                             summarize: teamsToolContext.summarize,
                         },
                     }),

package/dist/senses/telegram-approval-runtime.js

@@ -41,6 +41,7 @@ exports.executeApprovedTelegramTool = executeApprovedTelegramTool;
 exports.createTelegramApprovalRuntime = createTelegramApprovalRuntime;
 const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
+const friends_1 = require("@ouro.bot/friends");
 const approval_files_1 = require("../heart/approval-files");
 const approval_store_1 = require("../heart/approval-store");
 const tool_approval_1 = require("../heart/tool-approval");
@@ -52,6 +53,7 @@ const telegram_1 = require("./telegram");
 const context_1 = require("../mind/context");
 const session_transaction_1 = require("../mind/session-transaction");
 const tools_1 = require("../repertoire/tools");
+const mcp_manager_1 = require("../repertoire/mcp-manager");
 const runtime_1 = require("../nerves/runtime");
 const telegram_client_1 = require("./telegram-client");
 function telegramApprovalCommitBarrierHooks(effectBarrier) {
@@ -89,7 +91,17 @@ async function executeApprovedTelegramTool(name, args, execute, scenarioHandleDi
         });
     try {
         effectBarrier();
-        const result = await execute(name, args);
+        const outcome = await execute(name, args);
+        if (outcome.kind !== "handler_succeeded") {
+            if (name === "unraid_restart_container")
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error", component: "senses", event: "senses.telegram_approved_restart_error",
+                    message: "approved Sanctuary restart did not complete",
+                    meta: { ...(scenarioHandleDigest ? { scenarioHandleDigest } : {}), ...(approvalId ? { approvalId } : {}), outcome: outcome.kind },
+                });
+            return outcome;
+        }
+        const result = outcome.text;
         if (name === "sanctuary_resume_download_queue") {
             let parsed;
             try {
@@ -99,14 +111,14 @@ async function executeApprovedTelegramTool(name, args, execute, scenarioHandleDi
                 throw new tool_approval_1.ApprovalExecutionFailedError("approved download resume returned an invalid result");
             }
             const data = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-            const outcome = data?.data && typeof data.data === "object" && !Array.isArray(data.data) ? data.data : null;
-            const after = outcome?.after && typeof outcome.after === "object" && !Array.isArray(outcome.after) ? outcome.after : null;
-            if (data?.ok !== true || outcome?.verified !== true || after?.paused !== false)
+            const verification = data?.data && typeof data.data === "object" && !Array.isArray(data.data) ? data.data : null;
+            const after = verification?.after && typeof verification.after === "object" && !Array.isArray(verification.after) ? verification.after : null;
+            if (data?.ok !== true || verification?.verified !== true || after?.paused !== false)
                 throw new tool_approval_1.ApprovalExecutionFailedError("approved download resume was not independently verified");
-            return result;
+            return outcome;
         }
         if (name !== "unraid_restart_container")
-            return result;
+            return outcome;
         let parsed;
         try {
             parsed = JSON.parse(result);
@@ -147,7 +159,7 @@ async function executeApprovedTelegramTool(name, args, execute, scenarioHandleDi
             message: "approved Sanctuary restart execution completed",
             meta: { ...(scenarioHandleDigest ? { scenarioHandleDigest } : {}), ...(approvalId ? { approvalId } : {}), observedRestart: true },
         });
-        return result;
+        return outcome;
     }
     catch (error) {
         if (name === "unraid_restart_container")
@@ -176,9 +188,42 @@ function createTelegramApprovalRuntime(options) {
     const acceptanceMarker = options.dependencies?.acceptanceMarker ?? (() => (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)(options.agentName));
     const provider = options.dependencies?.runProvider ?? core_1.runAgent;
     const resolveTool = options.dependencies?.resolveTool ?? tools_1.resolveToolDefinition;
-    const executeTool = options.dependencies?.executeTool ?? tools_1.execTool;
     const agentRoot = options.dependencies?.agentRoot ?? (0, identity_1.getAgentRoot)(options.agentName);
-    const liveToolContext = { ...options.toolContext, agentRoot: options.toolContext.agentRoot ?? agentRoot };
+    const owner = Object.freeze({ agentName: options.agentName, agentRoot });
+    const currentOptions = async (record) => {
+        try {
+            if (!options.resolveLiveToolContext)
+                throw new Error("current owner authority producer is unavailable");
+            const context = await options.resolveLiveToolContext(record);
+            const relationship = context.relationshipAuthorization;
+            if (context.agentName !== owner.agentName || context.agentRoot !== owner.agentRoot
+                || relationship?.profileId !== "sanctuary-owner" || relationship.actor?.trustLevel !== "family"
+                || context.context?.friend.trustLevel !== "family" || context.context.friend.id !== relationship.actor.friendId
+                || context.currentSession?.friendId !== relationship.actor.friendId
+                || context.currentSession.key !== record.sessionKey || context.currentSession.sessionPath !== record.sessionPath) {
+                throw new Error("current approval owner coordinates are not exact");
+            }
+            const runtime = await (options.dependencies?.getProviderRuntime ?? core_1.getProviderRuntime)("human", owner);
+            const mcpManager = await (options.dependencies?.getSharedMcpManager ?? mcp_manager_1.getSharedMcpManager)(owner) ?? undefined;
+            const selectCurrentTools = () => (0, tools_1.selectToolsForChannel)((0, friends_1.getChannelCapabilities)("telegram"), context.context?.friend.toolPreferences, context.context, runtime.capabilities, mcpManager, runtime.model, context);
+            return {
+                providerRuntimeOverride: runtime, mcpManager,
+                toolContext: { ...context, toolSelection: selectCurrentTools(), selectCurrentTools },
+            };
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn", component: "senses", event: "senses.telegram_approval_authority_unavailable",
+                message: "current approval authority could not be reconstructed; execution remains disabled",
+                meta: { approvalId: record.approvalId, category: error instanceof Error ? error.name : "unknown" },
+            });
+            return null;
+        }
+    };
+    const invocationContext = (current, definition) => ({
+        ...current.toolContext,
+        toolSelection: Object.freeze({ ordinary: Object.freeze([definition]), engine: Object.freeze([]) }),
+    });
     const stateRoot = path.join(agentRoot, "state", "approvals");
     const store = (0, approval_store_1.openApprovalStore)({ databasePath: path.join(stateRoot, "approvals.sqlite"), now: () => new Date(now()) });
     const checkpoints = new approval_files_1.FileApprovalCheckpointStore(path.join(stateRoot, "checkpoints.json"));
@@ -297,6 +342,8 @@ function createTelegramApprovalRuntime(options) {
             const continuationOwnerId = `telegram-continuation-${(0, node_crypto_1.randomUUID)()}`;
             let continuationEpoch = 0;
             let continuationCausalEventId;
+            let continuationAuthorized = false;
+            let controlNotice;
             const continuationCoordinator = {
                 propose: (request) => coordinator({
                     sessionPath: record.sessionPath,
@@ -321,7 +368,11 @@ function createTelegramApprovalRuntime(options) {
                 markContinuationAttempted: () => { effectBarrier(); store.markContinuationAttempted({ approvalId: record.approvalId, ownerId: continuationOwnerId, epoch: continuationEpoch }); },
                 completeContinuation: () => { effectBarrier(); store.completeContinuation({ approvalId: record.approvalId, ownerId: continuationOwnerId, epoch: continuationEpoch }); },
                 runAgent: provider,
-                runAgentOptions: approvalContinuationRunAgentOptions(liveToolContext, continuationCoordinator),
+                revalidate: async () => {
+                    const current = await currentOptions(record);
+                    continuationAuthorized = current !== null;
+                    return current ? { ...current, ...approvalContinuationRunAgentOptions(current.toolContext, continuationCoordinator) } : null;
+                },
                 persist: (messages, result) => {
                     effectBarrier();
                     const existingEventIds = new Set((0, session_events_1.loadSessionEnvelopeFile)(record.sessionPath)?.events.map((event) => event.id) ?? []);
@@ -332,6 +383,15 @@ function createTelegramApprovalRuntime(options) {
                 },
                 deliver: async (text) => {
                     effectBarrier();
+                    if (!continuationAuthorized) {
+                        controlNotice = text;
+                        (0, runtime_1.emitNervesEvent)({
+                            component: "senses", event: "senses.telegram_approval_control_only",
+                            message: "approval result will use its existing terminal control instead of an unauthorized Butler message",
+                            meta: { approvalId: record.approvalId, state: record.state },
+                        });
+                        return;
+                    }
                     const messageIds = await options.effects.sendText({ idempotencyKey: `approval:${record.approvalId}:continuation:${(0, node_crypto_1.createHash)("sha256").update(text).digest("hex")}`, chatId: options.authorizedChatId, text, authorClass: "butler", ...(continuationCausalEventId ? { causalEventId: continuationCausalEventId } : {}) });
                     effectBarrier();
                     if (acceptanceBinding) {
@@ -352,7 +412,7 @@ function createTelegramApprovalRuntime(options) {
                     }
                 },
             });
-            return terminalOutcome(record);
+            return { ...terminalOutcome(record), ...(controlNotice ? { terminalText: controlNotice } : {}) };
         });
     };
     transport = (0, telegram_client_1.createTelegramApprovalTransport)({
@@ -397,6 +457,7 @@ function createTelegramApprovalRuntime(options) {
             }
             else if (existing.state === "proposed") {
                 const ownerId = `telegram-decision-${(0, node_crypto_1.randomUUID)()}`;
+                let definition;
                 record = await (0, session_transaction_1.withSessionTurnLease)(existing.sessionPath, async (lease) => (0, tool_approval_1.executeApprovalDecision)({
                     approvalStore: store,
                     checkpointStore: checkpoints,
@@ -410,16 +471,31 @@ function createTelegramApprovalRuntime(options) {
                     },
                     ownerId,
                     currentSessionRevision: (0, session_transaction_1.readSessionTransaction)(existing.sessionPath, lease).revision,
-                    resolveTool,
-                    resolveApprovalPolicy: (name, args) => (0, tools_1.approvalPolicyForInvocation)(name, args, liveToolContext),
+                    resolveTool: async (name) => {
+                        const current = await currentOptions(existing);
+                        definition = current ? resolveTool(name, current.toolContext.toolSelection) : undefined;
+                        return definition;
+                    },
+                    resolveApprovalPolicy: async (name, args) => {
+                        const current = await currentOptions(existing);
+                        return current ? (0, tools_1.approvalPolicyForInvocation)(name, args, current.toolContext) : { kind: "not_required" };
+                    },
                     liveGuard: async () => ({ ok: true }),
                     liveRisk: async () => ({ ok: true }),
+                    preflight: async (context) => {
+                        const current = await currentOptions(existing);
+                        if (!current)
+                            return { ok: false, reason: "current tool authority is unavailable" };
+                        const result = await (0, tools_1.preflightToolCall)(context.record.toolName, context.arguments, invocationContext(current, context.definition));
+                        return result.kind === "ready" ? { ok: true } : { ok: false, reason: result.text };
+                    },
                     hooks: telegramApprovalDecisionBarrierHooks(effectBarrier),
-                    execute: (name, args) => {
-                        const approvedToolContext = name === "unraid_restart_container"
-                            ? { ...options.toolContext, relationshipAuthorization: undefined }
-                            : options.toolContext;
-                        const execute = () => executeApprovedTelegramTool(name, args, (toolName, toolArgs) => executeTool(toolName, toolArgs, approvedToolContext), decisionScenarioDigest, existing.approvalId, effectBarrier);
+                    execute: async (name, args) => {
+                        const current = await currentOptions(existing);
+                        if (!current || !definition)
+                            return { kind: "rejected_before_handler", text: "current approved tool authority is unavailable" };
+                        const approvedToolContext = invocationContext(current, definition);
+                        const execute = () => executeApprovedTelegramTool(name, args, (toolName, toolArgs) => (0, tools_1.executeTool)(toolName, toolArgs, approvedToolContext, options.dependencies?.executeTool), decisionScenarioDigest, existing.approvalId, effectBarrier);
                         return decisionScenarioDigest
                             ? (0, sanctuary_acceptance_marker_1.runWithSanctuaryAcceptanceApproval)({ approvalId: existing.approvalId, argumentDigest: existing.argumentDigest }, execute)
                             : execute();
@@ -460,7 +536,7 @@ function createTelegramApprovalRuntime(options) {
                 if (!existing) {
                     if (mustFailClosed)
                         throw new Error("Telegram fenced approval journal is unavailable");
-                    const orphanRecovery = await transport.terminalizeOrphaned(pending.approvalId, "⚠️ Approval record is unavailable — no action was taken");
+                    const orphanRecovery = await transport.terminalizeOrphaned(pending.approvalId, "⚠️ Approval record is unavailable — the action outcome is unknown and will not be retried");
                     (0, runtime_1.emitNervesEvent)({
                         component: "senses",
                         event: "senses.telegram_approval_orphan_recovered",
@@ -562,5 +638,38 @@ function createTelegramApprovalRuntime(options) {
             subject: options.subject,
         });
     };
-    return { transport, coordinator, legacySubjects, migrateIdentity, recover, close: () => store.close() };
+    const isPendingTerminalControl = async (input) => {
+        if (input.authorClass !== "control")
+            return false;
+        const effect = input.effect;
+        for (const pending of transport.listPendingDeliveries()) {
+            const record = store.read(pending.approvalId);
+            if (!record || !pending.messageId || record.transport !== "telegram"
+                || record.requesterId !== options.subject || record.transportUserId !== options.subject
+                || record.transportChatId !== options.subject || record.sessionKey !== `telegram:${options.subject}`
+                || record.transportMessageId !== opaqueTelegramMessageBinding(options.subject, pending.messageId)
+                || !["succeeded", "failed", "attempted_indeterminate", "denied", "expired", "drifted", "session_head_changed", "abandoned_before_attempt"].includes(record.state)
+                || (pending.terminal && pending.terminal.accepted !== (record.state === "succeeded")))
+                continue;
+            let matches = false;
+            if (effect.kind === "callback_ack") {
+                const digest = (0, node_crypto_1.createHash)("sha256").update(effect.callbackQueryId).digest("hex");
+                matches = Boolean(pending.terminal && effect.text === undefined && effect.showAlert !== true
+                    && pending.decisionAttempt?.queryIdDigest === digest && input.idempotencyKey === `approval-callback:${digest}`);
+            }
+            else if (effect.kind === "edit") {
+                const terminalText = pending.terminal?.terminalText
+                    ?? (record.state === "expired" && pending.expiryObservation?.deadlineAt === pending.expiresAt
+                        && pending.expiryObservation.observedAt >= pending.expiresAt ? telegram_client_1.TELEGRAM_APPROVAL_EXPIRED_TEXT : undefined);
+                matches = terminalText !== undefined && effect.text === terminalText && effect.messageId === Number(pending.messageId)
+                    && input.idempotencyKey === `approval:${pending.approvalId}:edit:${(0, node_crypto_1.createHash)("sha256").update(terminalText).digest("hex")}`;
+            }
+            if (!matches)
+                continue;
+            await transport.validatePendingTerminalControl(pending.approvalId);
+            return true;
+        }
+        return false;
+    };
+    return { transport, coordinator, legacySubjects, migrateIdentity, recover, isPendingTerminalControl, close: () => store.close() };
 }

package/dist/senses/telegram-client.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TELEGRAM_APPROVAL_TOMBSTONE_TTL_MS = exports.TELEGRAM_APPROVAL_TERMINAL_EDIT_TIMEOUT_MS = exports.TELEGRAM_APPROVAL_TTL_MS = exports.FileTelegramPendingApprovalStore = exports.FileTelegramUpdateInboxStore = exports.FileTelegramOffsetStore = exports.TelegramApiError = void 0;
+exports.TELEGRAM_APPROVAL_TOMBSTONE_TTL_MS = exports.TELEGRAM_APPROVAL_TERMINAL_EDIT_TIMEOUT_MS = exports.TELEGRAM_APPROVAL_EXPIRED_TEXT = exports.TELEGRAM_APPROVAL_TTL_MS = exports.FileTelegramPendingApprovalStore = exports.FileTelegramUpdateInboxStore = exports.FileTelegramOffsetStore = exports.TelegramApiError = void 0;
 exports.createTelegramLongPoll = createTelegramLongPoll;
 exports.classifyTelegramPersistedApprovalState = classifyTelegramPersistedApprovalState;
 exports.createTelegramApprovalTransport = createTelegramApprovalTransport;
@@ -788,6 +788,7 @@ class FileTelegramPendingApprovalStore {
 }
 exports.FileTelegramPendingApprovalStore = FileTelegramPendingApprovalStore;
 exports.TELEGRAM_APPROVAL_TTL_MS = 300_000;
+exports.TELEGRAM_APPROVAL_EXPIRED_TEXT = "⚠️ Approval expired";
 exports.TELEGRAM_APPROVAL_TERMINAL_EDIT_TIMEOUT_MS = 30_000;
 exports.TELEGRAM_APPROVAL_TOMBSTONE_TTL_MS = 600_000;
 function assertTelegramCallbackData(value) {
@@ -1208,7 +1209,7 @@ function createTelegramApprovalTransport(options) {
                     }
                     const observation = ensureExpiryObservation(current);
                     await options.onExpire?.(current.approvalId);
-                    const terminalizedAt = await editTerminal(current, "⚠️ Approval expired", observation.observedAt);
+                    const terminalizedAt = await editTerminal(current, exports.TELEGRAM_APPROVAL_EXPIRED_TEXT, observation.observedAt);
                     if (current.acceptanceBinding)
                         persistMutation(current, () => retainTerminalTombstone(current, terminalizedAt));
                     else {
@@ -1225,6 +1226,22 @@ function createTelegramApprovalTransport(options) {
             throw firstFailure;
     };
     return {
+        async validatePendingTerminalControl(approvalId) {
+            const pending = uniquePending().find((entry) => entry.approvalId === approvalId);
+            if (!pending || !options.signAcceptanceEvidence)
+                throw new Error("Telegram terminal control integrity is unavailable");
+            const state = classifyTelegramPersistedApprovalState(pending);
+            if (state === "action_terminal") {
+                await validateDecisionAttempt(pending);
+                validateTerminalOutcome(pending);
+            }
+            else if (state === "expiry_observed") {
+                validateExpiryObservation(pending);
+            }
+            else {
+                throw new Error("Telegram pending terminal control is not authenticated");
+            }
+        },
         async sendApproval(input) {
             effectBarrier();
             const approveCallbackData = `a:${options.createOpaqueHandle()}`;

package/dist/senses/telegram.js

@@ -846,6 +846,7 @@ function createTelegramSenseApp(options) {
         throw primaryError;
     };
     let effectJournal;
+    let approvalRuntime;
     const getEffectJournal = () => {
         effectJournal ??= new telegram_effect_adapter_1.FileTelegramEffectJournal(path.join(agentRoot, "state", "telegram", "effects"));
         return effectJournal;
@@ -867,6 +868,13 @@ function createTelegramSenseApp(options) {
         if (input.authorClass === "system_failsafe" && (input.effect.kind !== "text" || input.effect.text !== telegram_effect_adapter_1.FIXED_USENET_SYSTEM_FAILSAFE || !input.idempotencyKey.startsWith("system-failsafe:"))) {
             return { allowed: false, reason: "system failsafe shape is not fixed" };
         }
+        if (target.friendId === configuredOwnerFriendId && target.sessionKey === configuredOwnerSessionKey
+            && await approvalRuntime?.isPendingTerminalControl?.(input)) {
+            return {
+                allowed: true, receiptId: `approval-terminal:${(0, node_crypto_1.createHash)("sha256").update(input.idempotencyKey).digest("hex")}`,
+                expiresAt: new Date(Date.now() + 5 * 60_000).toISOString(), transport: { chatId: authorizedChatId },
+            };
+        }
         if (options.authorizeRelationshipEffect) {
             if (target.friendId === configuredOwnerFriendId && target.sessionKey !== configuredOwnerSessionKey)
                 return { allowed: false, reason: "owner relationship session binding changed" };
@@ -891,7 +899,6 @@ function createTelegramSenseApp(options) {
     };
     const approvalEffects = (0, telegram_effect_adapter_1.createTelegramApprovalEffectPort)({ target: configuredOwnerTarget(), chatId: authorizedChatId, execute: executeAuthorizedEffect, record: recordConfiguredOwnerEffect });
     let toolContext;
-    let approvalRuntime;
     let approvalTransport;
     let interactiveControl;
     try {
@@ -906,9 +913,38 @@ function createTelegramSenseApp(options) {
             subject,
             identityKey,
             toolContext: toolContext ?? {},
+            resolveLiveToolContext: async (record) => {
+                const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
+                if (record.transport !== "telegram" || record.requesterId !== subject
+                    || record.transportUserId !== subject || record.transportChatId !== subject
+                    || record.sessionKey !== configuredOwnerSessionKey || path.resolve(record.sessionPath) !== path.resolve(sessionPath)) {
+                    throw new Error("approval is not bound to the configured owner session");
+                }
+                const envelope = (0, session_events_1.loadSessionEnvelopeFile)(sessionPath);
+                const ingress = envelope && (0, session_events_1.selectEffectiveSessionEvents)(envelope.events).findLast((event) => event.role === "user");
+                if (!ingress)
+                    throw new Error("approval owner ingress is unavailable");
+                const relationshipAuthorization = await resolveLiveRelationshipAuthorization({
+                    friendId: configuredOwnerFriendId, requestId: `approval:${record.approvalId}`, sessionEventId: ingress.id,
+                    botId: botId, userId: authorizedUserId, chatId: authorizedChatId, sessionKey: configuredOwnerSessionKey,
+                });
+                if (relationshipAuthorization.profileId !== "sanctuary-owner")
+                    throw new Error("approval owner profile is unavailable");
+                const friendStore = new friends_1.FileFriendStore(path.join(agentRoot, "friends"));
+                const friend = await friendStore.get(configuredOwnerFriendId);
+                if (!friend)
+                    throw new Error("approval owner Friend is unavailable");
+                return {
+                    ...toolContext, signin: async () => undefined, agentName: options.agentName, agentRoot,
+                    currentSession: { friendId: friend.id, channel: "telegram", key: configuredOwnerSessionKey, sessionPath },
+                    currentUserMessage: (0, session_events_1.extractEventText)(ingress),
+                    context: { friend, channel: (0, friends_1.getChannelCapabilities)("telegram") }, friendStore, relationshipAuthorization,
+                };
+            },
             effects: approvalEffects,
             effectBarrier: acceptanceAuditBarrier,
             dependencies: {
+                agentRoot,
                 acceptanceMarker: () => {
                     const scenarioHandleDigest = readScenarioHandleDigest();
                     return scenarioHandleDigest ? { scenarioHandleDigest } : null;
@@ -1075,25 +1111,28 @@ function createTelegramSenseApp(options) {
             (0, runtime_1.emitNervesEvent)({ level: "error", component: "senses", event: "senses.telegram_system_failsafe_error", message: "Telegram system failsafe reconciliation failed", meta: { agentName: options.agentName, subject, error: transportError(error) } });
         }
     };
+    async function resolveLiveRelationshipAuthorization(input) {
+        if (!options.resolveRelationshipAuthorization)
+            throw new Error("Telegram relationship authorization resolver is unavailable");
+        const authorization = await options.resolveRelationshipAuthorization(input);
+        if (authorization.subject.friendId !== input.friendId || authorization.subject.admissionState !== "active")
+            throw new Error("Telegram relationship admission is not active");
+        return {
+            requestId: input.requestId,
+            profileId: authorization.profileId,
+            authorizedContextScopes: authorization.authorizedContextScopes,
+            advertisedToolNames: authorization.advertisedToolNames,
+            actor: authorization.actor,
+            resolveCurrent: () => resolveLiveRelationshipAuthorization(input),
+            authorizeTool: async (name, args) => (await options.resolveRelationshipAuthorization(input)).authorizeTool(name, args),
+        };
+    }
     const prepareRelationshipRunAgentOptions = (input) => {
         if (!options.resolveRelationshipAuthorization)
             throw new Error("Telegram relationship authorization resolver is unavailable");
         const relationshipCoordinates = { ...input, botId: botId };
-        const resolveLiveRelationshipAuthorization = async () => {
-            const authorization = await options.resolveRelationshipAuthorization(relationshipCoordinates);
-            if (authorization.subject.friendId !== input.friendId || authorization.subject.admissionState !== "active")
-                throw new Error("Telegram relationship admission is not active");
-            return {
-                requestId: input.requestId,
-                profileId: authorization.profileId,
-                authorizedContextScopes: authorization.authorizedContextScopes,
-                advertisedToolNames: authorization.advertisedToolNames,
-                actor: authorization.actor,
-                authorizeTool: async (name, args) => (await options.resolveRelationshipAuthorization(relationshipCoordinates)).authorizeTool(name, args),
-            };
-        };
         return async ({ runAgentOptions, activeCares = [], careEvidenceNow = Date.now() }) => {
-            const relationshipAuthorization = await resolveLiveRelationshipAuthorization();
+            const relationshipAuthorization = await resolveLiveRelationshipAuthorization(relationshipCoordinates);
             const isSanctuaryOwner = options.agentName === "sanctuary" && relationshipAuthorization.profileId === "sanctuary-owner";
             const isSanctuaryHouseholdConversation = options.agentName === "sanctuary"
                 && (relationshipAuthorization.profileId === "sanctuary-owner" || relationshipAuthorization.profileId === "sanctuary-household");