@ouro.bot/cli 0.1.0-alpha.810 → 0.1.0-alpha.812

package/changelog.json

@@ -1,6 +1,24 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.812",
+      "changes": [
+        "Accept Sanctuary's existing private frontend socket during deployment audits while retaining exact listener and ownership checks."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.811",
+      "changes": [
+        "Bind tool discovery and execution to the initiating agent with canonical schemas, per-owner MCP connections and current authorization.",
+        "Keep tool schema validation isolated so repeated schema IDs work across turns without borrowing another tool's schema registrations.",
+        "Expose Sanctuary's resident native tools only to the configured owner while preserving household and event exclusions and role-specific containment.",
+        "Match Sanctuary's Unit-16e containment evidence to the canonical three-mount deployment and reject malformed root-mode observations at both the broker and adapter boundaries.",
+        "Preserve approval effect outcomes without replay, confine session reads and isolate foreground and background shell ownership.",
+        "Keep CLI and realtime voice tool contexts owner-bound across delayed discovery, transport failure and cancellation.",
+        "Allow coverage gates to reuse installed Mailbox UI dependencies through an explicit skip-install option without skipping validation."
+      ]
+    },
     {
       "version": "0.1.0-alpha.810",
       "changes": [

package/deploy/unraid/README.txt

@@ -2787,12 +2787,9 @@ Packaged deployment-target containment gates:
   closed after eight attempts. It always makes bounded exact-ID unpause attempts,
   verifies the same ID and PID resumed their original running, unpaused state,
   and only then performs the final full-profile topology capture. It
-  rejects every owned UDP listener and every externally reachable owned TCP listener. Only loopback
-  Mailbox port 6876 plus stream-listening endpoints at the fixed daemon and
-  acceptance Unix control paths are permitted; all other named Unix endpoint
-  types (including datagrams) fail closed. Inherited descriptors for the same
-  socket inode are deduplicated, while unknown loopback ports, wildcard/host-address
-  listeners, process/socket/listener drift, or ambiguous ownership fail closed.
+  rejects every owned UDP listener and every externally reachable owned TCP listener.
+  Only loopback Mailbox port 6876 plus stream-listening endpoints at /tmp/ouroboros-daemon.sock, /tmp/ouroboros-daemon.sock.frontend, and /home/ouro/AgentBundles/sanctuary.ouro/state/acceptance/telegram-control.sock are permitted; all other named Unix endpoint types (including datagrams) fail closed.
+  Inherited descriptors for the same socket inode are deduplicated, while unknown loopback ports, wildcard/host-address listeners, process/socket/listener drift, or ambiguous ownership fail closed.
   Unit 18 uses the separately packaged fixed final command after activation.
   It accepts either the legacy-adoption topology with no canonical rollback or
   exactly one stopped, non-autostarted rollback; running/autostarted rollback,

package/deploy/unraid/sanctuary-acceptance-contract.json

@@ -70,7 +70,7 @@
     "restart-attempt-ledger": { "kind": "fixed-ndjson", "path": "/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance/restart-attempts.ndjson", "redaction": "scenario-action-target-digests-and-state-only" },
     "telegram-turn-receipts": { "kind": "fixed-ndjson", "path": "/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance/telegram-turns.ndjson", "redaction": "scenario-update-tool-response-and-delivery-digests-only" },
     "read-only-denial-receipt": { "kind": "persisted-one-shot-live-graphql-denial", "schemaVersion": "sanctuary-read-only-denial-receipt-v1", "path": "/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance/denial-receipts/<scenario-handle-digest>.json", "attemptPath": "/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance/denial-attempts/<scenario-handle-digest>.json", "endpoint": "http://127.0.0.1/graphql", "targetSnapshotOperation": "denial_target_snapshot", "resumePolicy": "attempted-or-indeterminate-inspect-before-retry", "redaction": "schema-binding-api-classification-counts-restart-count-and-seven-boundary-digests-only" },
-    "containment-audit": { "kind": "effective-container-key-tool-and-audit-boundary", "schemaVersion": "sanctuary-containment-audit-v1", "path": "/home/ouro/AgentBundles/sanctuary.ouro/tool-profiles.json", "auditPath": "/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance/telegram-audit-chain.ndjson", "producers": ["container_snapshot", "inventory_keys", "live-bundle-relationship-capability-registry", "runtime-tool-resolver", "telegram-audit-mac-chain"], "redaction": "counts-static-policy-values-and-sha256-digests-only" },
+    "containment-audit": { "kind": "effective-container-key-tool-and-audit-boundary", "schemaVersion": "sanctuary-containment-audit-v2", "path": "/home/ouro/AgentBundles/sanctuary.ouro/tool-profiles.json", "auditPath": "/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance/telegram-audit-chain.ndjson", "producers": ["container_snapshot", "inventory_keys", "live-bundle-relationship-capability-registry", "canonical-turn-selection", "current-relationship-provider-gates", "telegram-audit-mac-chain"], "redaction": "counts-static-policy-values-and-sha256-digests-only" },
     "container-inspect": { "kind": "fixed-host-snapshot", "path": "/run/ouro-acceptance/container-inspect.json", "redaction": "typed-facts-and-digests-only" },
     "provider-live-check": { "kind": "fixed-runtime-api", "operation": "sanctuary-provider-readiness", "redaction": "exact same-provider lane selection, one credential revision, live ping attempts, and no-fallback booleans only" },
     "live-grounding-read": { "kind": "fixed-runtime-api", "operation": "sanctuary-independent-system-or-storage-read", "redaction": "bounded-system-or-storage-facts-and-digest-only" },

package/deploy/unraid/sanctuary-deployment-target.mjs

@@ -16,6 +16,7 @@ const PROFILES = Object.freeze({
 })
 const DOCUMENTED_UNIX_CONTROLS = [
   "/tmp/ouroboros-daemon.sock",
+  "/tmp/ouroboros-daemon.sock.frontend",
   "/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance/telegram-control.sock",
 ]
 const DOCUMENTED_LOOPBACK_TCP_CONTROLS = new Set([6876])

package/deploy/unraid/sanctuary-unit16-host-broker.mjs

@@ -492,6 +492,7 @@ async function containerSnapshot(expectedImage) {
     || typeof value.startedAt !== "string" || !/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[^\s]{1,64}Z$/u.test(value.startedAt)) {
     throw new Error("production container identity is invalid")
   }
+  if (typeof value.readOnlyRoot !== "boolean") throw new Error("production container root mode is invalid")
   const ports = object(value.ports ?? {}, "published ports")
   const publishedPortCount = Object.values(ports).reduce((count, bindings) => count + (Array.isArray(bindings) ? bindings.length : 0), 0)
   const mounts = Array.isArray(value.mounts) ? value.mounts.map((raw) => {
@@ -499,14 +500,14 @@ async function containerSnapshot(expectedImage) {
     return { destination: mount.Destination, source: mount.Source, mode: mount.Mode, propagation: mount.Propagation, rw: mount.RW, type: mount.Type }
   }).sort((left, right) => String(left.destination).localeCompare(String(right.destination))) : []
   const expectedMounts = [
-    { destination: "/home/ouro/.ouro-cli", source: PRODUCTION_RUNTIME_SOURCE, mode: "rw", propagation: "rprivate", rw: true, type: "bind" },
-    { destination: "/home/ouro/AgentBundles/sanctuary.ouro", source: PRODUCTION_BUNDLE_SOURCE, mode: "rw", propagation: "rprivate", rw: true, type: "bind" },
-    { destination: "/run/ouro-events", source: PRODUCTION_EVENT_SPOOL_SOURCE, mode: "ro", propagation: "rprivate", rw: false, type: "bind" },
+    { destination: "/home/ouro/.ouro-cli", source: PRODUCTION_RUNTIME_SOURCE, propagation: "rprivate", rw: true, type: "bind" },
+    { destination: "/home/ouro/AgentBundles/sanctuary.ouro", source: PRODUCTION_BUNDLE_SOURCE, propagation: "rprivate", rw: true, type: "bind" },
+    { destination: "/run/ouro-events", source: PRODUCTION_EVENT_SPOOL_SOURCE, propagation: "rprivate", rw: false, type: "bind" },
   ]
-  const mountsExact = mounts.length === expectedMounts.length && expectedMounts.every((expected) => mounts.some((mount) => mount.destination === expected.destination && mount.source === expected.source && mount.mode === expected.mode && mount.propagation === expected.propagation && mount.rw === expected.rw && mount.type === expected.type))
+  const mountsExact = mounts.length === expectedMounts.length && expectedMounts.every((expected) => mounts.some((mount) => mount.destination === expected.destination && mount.source === expected.source && mount.propagation === expected.propagation && mount.rw === expected.rw && mount.type === expected.type))
   const securityExact = value.privileged === false && (value.capAdd === null || (Array.isArray(value.capAdd) && value.capAdd.length === 0))
-    && JSON.stringify(value.capDrop) === JSON.stringify(["ALL"])
-    && JSON.stringify(value.securityOpt) === JSON.stringify(["no-new-privileges"])
+    && (value.capDrop === null || (Array.isArray(value.capDrop) && value.capDrop.length === 0))
+    && (value.securityOpt === null || (Array.isArray(value.securityOpt) && value.securityOpt.length === 0))
   const running = value.running === true
   if (!running) throw new Error("production container is not running")
   const configuredUser = text(value.user, "container user")
@@ -534,7 +535,7 @@ async function containerSnapshot(expectedImage) {
     user: configuredUser,
     liveProcessUser,
     processBindingDigest,
-    readOnlyRoot: value.readOnlyRoot === true,
+    readOnlyRoot: value.readOnlyRoot,
     mountCount: mounts.length,
     mountsDigest: createHash("sha256").update(JSON.stringify(mounts)).digest("hex"),
     mountsExact,

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.810",
+  "runtimeVersion": "0.1.0-alpha.812",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.ouro/psyche/IDENTITY.md

@@ -2,4 +2,4 @@
 
 I am Mendelow Cloud Butler. I care for Ari's home services and help approved household members over Telegram. Ari is my family-trust operator; each other person has their own relationship, permissions, conversation, preferences, and return route.
 
-I live in a non-root container on the Unraid host internally named `sanctuary`. People do not need to say Sanctuary or know which backend serves a household outcome. My primary server interface is the typed Unraid GraphQL repertoire, never shell.
+I live in a non-root container on the Unraid host internally named `sanctuary`. People do not need to say Sanctuary or know which backend serves a household outcome. I use the typed Unraid GraphQL repertoire for server operations and owner-authorized native tools for resident work inside my existing container boundary.

package/deploy/unraid/sanctuary.ouro/tool-profiles.json

@@ -2,9 +2,9 @@
   "version": 2,
   "profiles": {
     "sanctuary-owner": {
-      "version": 7,
+      "version": 8,
       "contextScopes": ["household.status", "household.policy", "household.private"],
-      "toolNames": ["external_event_disposition", "query_active_work", "save_friend_note", "telegram_contact_manage", "query_cares", "care_manage", "await_condition", "resolve_await", "cancel_await", "list_recent_attachments", "materialize_attachment", "describe_image", "unraid_list_containers", "unraid_get_container_logs", "unraid_get_storage", "sanctuary_get_media_optimization", "sanctuary_search_media_catalog", "unraid_get_disks", "unraid_get_notifications", "unraid_get_system", "sanctuary_get_install_state", "unraid_check_services", "sanctuary_get_download_queue", "sanctuary_resume_download_queue", "unraid_restart_container", "steward_policy_manage", "send_message", "ponder", "rest", "settle", "speak"],
+      "toolNames": ["external_event_disposition", "query_active_work", "save_friend_note", "telegram_contact_manage", "query_cares", "care_manage", "await_condition", "resolve_await", "cancel_await", "list_recent_attachments", "materialize_attachment", "describe_image", "unraid_list_containers", "unraid_get_container_logs", "unraid_get_storage", "sanctuary_get_media_optimization", "sanctuary_search_media_catalog", "unraid_get_disks", "unraid_get_notifications", "unraid_get_system", "sanctuary_get_install_state", "unraid_check_services", "sanctuary_get_download_queue", "sanctuary_resume_download_queue", "unraid_restart_container", "steward_policy_manage", "send_message", "ponder", "rest", "settle", "speak", "shell", "shell_status", "shell_tail", "read_file", "write_file", "edit_file", "glob", "grep", "web_search", "search_facts", "consult_diary", "consult_notes", "get_friend_note", "session_summary", "query_session", "set_reasoning_effort", "restart_runtime", "revive_sense"],
       "effectScopes": ["telegram.proactive", "telegram.request_return", "telegram.owner_event"]
     },
     "sanctuary-household": {

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.810</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.812</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/config.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidSessionPathError = void 0;
 exports.loadConfig = loadConfig;
 exports.resetConfigCache = resetConfigCache;
 exports.cacheRuntimeConfigForTests = cacheRuntimeConfigForTests;
@@ -59,6 +60,7 @@ exports.getLogsDir = getLogsDir;
 exports.sanitizeKey = sanitizeKey;
 exports.canonicalizeTelegramSessionKey = canonicalizeTelegramSessionKey;
 exports.slugify = slugify;
+exports.isValidSessionCoordinate = isValidSessionCoordinate;
 exports.resolveSessionPath = resolveSessionPath;
 exports.sessionPath = sessionPath;
 exports.logPath = logPath;
@@ -373,12 +375,40 @@ function slugify(value) {
         .replace(/^-+/, "")
         .replace(/-+$/, "");
 }
+class InvalidSessionPathError extends Error {
+}
+exports.InvalidSessionPathError = InvalidSessionPathError;
+function isValidSessionCoordinate(value) {
+    return typeof value === "string" && value.length > 0 && value !== "." && value !== ".." && !/[/\\\0]/.test(value);
+}
+function isInsideSessionRoot(root, target) {
+    const relative = path.relative(root, target);
+    return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
 function resolveSessionPath(friendId, channel, key, options) {
-    const dir = path.join((0, identity_1.getAgentRoot)(), "state", "sessions", friendId, channel);
+    const agentRoot = options?.agentRoot ?? (0, identity_1.getAgentRoot)();
+    if (options?.confined && (!isValidSessionCoordinate(friendId) || !isValidSessionCoordinate(channel)
+        || typeof key !== "string" || key.includes("\0") || !path.isAbsolute(agentRoot))) {
+        throw new InvalidSessionPathError("invalid session coordinates");
+    }
+    const sessionsRoot = path.join(agentRoot, "state", "sessions");
+    const dir = path.join(sessionsRoot, friendId, channel);
+    const file = path.join(dir, sanitizeKey(key) + ".json");
+    if (options?.confined) {
+        if (!isInsideSessionRoot(sessionsRoot, file))
+            throw new InvalidSessionPathError("session path escapes its root");
+        if (fs.existsSync(file)) {
+            const realSessionsRoot = fs.realpathSync(sessionsRoot);
+            if (!isInsideSessionRoot(fs.realpathSync(agentRoot), realSessionsRoot)
+                || !isInsideSessionRoot(realSessionsRoot, fs.realpathSync(file))) {
+                throw new InvalidSessionPathError("session path escapes the initiating agent");
+            }
+        }
+    }
     if (options?.ensureDir) {
         fs.mkdirSync(dir, { recursive: true });
     }
-    return path.join(dir, sanitizeKey(key) + ".json");
+    return file;
 }
 function sessionPath(friendId, channel, key) {
     return resolveSessionPath(friendId, channel, key, { ensureDir: true });