@ouro.bot/cli 0.1.0-alpha.810 → 0.1.0-alpha.812

package/dist/heart/frontend-approval-runtime.js

@@ -37,6 +37,7 @@ exports.settleFrontendApproval = settleFrontendApproval;
 exports.createFrontendApprovalRuntime = createFrontendApprovalRuntime;
 const node_crypto_1 = require("node:crypto");
 const path = __importStar(require("node:path"));
+const friends_1 = require("@ouro.bot/friends");
 const approval_files_1 = require("./approval-files");
 const approval_store_1 = require("./approval-store");
 const tool_approval_1 = require("./tool-approval");
@@ -52,12 +53,10 @@ const PERMISSION_OPTIONS = [
     { optionId: "allow-once", name: "Allow once", kind: "allow_once" },
     { optionId: "reject-once", name: "Reject", kind: "reject_once" },
 ];
-/* v8 ignore start -- lazy default adapter avoids widening every daemon test mock; settlement behavior is covered through the injected dependency @preserve */
-async function defaultReleaseRuntimeMcpServers() {
+async function defaultReleaseRuntimeMcpServers(owner) {
     const manager = await Promise.resolve().then(() => __importStar(require("../repertoire/mcp-manager")));
-    await manager.releaseRuntimeMcpServers();
+    await manager.releaseRuntimeMcpServers(owner);
 }
-/* v8 ignore stop */
 const DEFAULT_SETTLEMENT_DEPENDENCIES = {
     withTurnExecutionLease: turn_execution_lease_1.withTurnExecutionLease,
     setAgentName: identity_1.setAgentName,
@@ -66,7 +65,10 @@ const DEFAULT_SETTLEMENT_DEPENDENCIES = {
     executeApprovalDecision: tool_approval_1.executeApprovalDecision,
     resolveToolDefinition: tools_1.resolveToolDefinition,
     approvalPolicyForInvocation: tools_1.approvalPolicyForInvocation,
-    execTool: tools_1.execTool,
+    executeTool: tools_1.executeTool,
+    preflightToolCall: tools_1.preflightToolCall,
+    selectToolsForChannel: tools_1.selectToolsForChannel,
+    getProviderRuntime: core_1.getProviderRuntime,
     getSharedMcpManager: mcp_manager_1.getSharedMcpManager,
     releaseRuntimeMcpServers: defaultReleaseRuntimeMcpServers,
     loadSession: context_1.loadSession,
@@ -86,15 +88,18 @@ async function settleFrontendApproval(input, dependencies = DEFAULT_SETTLEMENT_D
     const record = input.approvalStore.read(input.suspension.approvalId);
     if (!record)
         throw new Error(`frontend approval record is unavailable: ${input.suspension.approvalId}`);
+    const owner = Object.freeze({ agentName: input.request.agent, agentRoot: input.agentRoot });
+    const toolsDisabled = input.request.disableTools === true;
+    const runtimeServers = input.request.runtimeMcpServers;
     return dependencies.withTurnExecutionLease(async () => {
-        dependencies.setAgentName(input.request.agent);
+        dependencies.setAgentName(owner.agentName);
         try {
-            const mcpManager = await dependencies.getSharedMcpManager(input.request.runtimeMcpServers ? { runtimeServers: input.request.runtimeMcpServers } : undefined) ?? undefined;
             return await dependencies.withSessionTurnLease(record.sessionPath, async (lease) => {
                 const currentRevision = dependencies.readSessionTransaction(record.sessionPath, lease).revision;
                 const continuationSignal = input.optionId === "cancelled" ? AbortSignal.abort() : input.signal;
                 const liveToolContext = input.approvalRequest.liveToolContext ?? {
                     signin: async () => undefined,
+                    agentName: owner.agentName,
                     agentRoot: input.agentRoot,
                     currentSession: {
                         friendId: input.request.friendId,
@@ -104,6 +109,47 @@ async function settleFrontendApproval(input, dependencies = DEFAULT_SETTLEMENT_D
                     },
                     currentUserMessage: input.request.message,
                 };
+                const currentOptions = async () => {
+                    try {
+                        if ((liveToolContext.agentName !== undefined && liveToolContext.agentName !== owner.agentName)
+                            || (liveToolContext.agentRoot !== undefined && liveToolContext.agentRoot !== owner.agentRoot)) {
+                            throw new Error("approval context owner coordinates changed");
+                        }
+                        let context = { ...liveToolContext, ...owner };
+                        const original = liveToolContext.relationshipAuthorization;
+                        if (original) {
+                            if (liveToolContext.agentName !== owner.agentName || liveToolContext.agentRoot !== owner.agentRoot) {
+                                throw new Error("approval context owner coordinates changed");
+                            }
+                            const current = await original.resolveCurrent?.();
+                            if (!current?.actor || current.actor.friendId !== input.request.friendId
+                                || current.actor.trustLevel !== original.actor?.trustLevel || current.profileId !== original.profileId
+                                || original.authorizedContextScopes.some((scope) => !current.authorizedContextScopes.includes(scope))) {
+                                throw new Error("current approval relationship authority is unavailable");
+                            }
+                            context = { ...context, relationshipAuthorization: current };
+                        }
+                        const providerRuntime = await dependencies.getProviderRuntime((0, friends_1.channelToFacing)(input.request.channel), owner);
+                        const mcpManager = toolsDisabled ? undefined : await dependencies.getSharedMcpManager({ ...owner, runtimeServers }) ?? undefined;
+                        const selectCurrentTools = () => toolsDisabled
+                            ? Object.freeze({ ordinary: Object.freeze([]), engine: Object.freeze([]) })
+                            : dependencies.selectToolsForChannel((0, friends_1.getChannelCapabilities)(input.request.channel), context.context?.friend.toolPreferences, context.context, providerRuntime.capabilities, mcpManager, providerRuntime.model, context);
+                        return {
+                            providerRuntimeOverride: providerRuntime, mcpManager,
+                            ...(toolsDisabled ? { tools: [], hardDisableTools: true } : {}),
+                            toolContext: { ...context, toolSelection: selectCurrentTools(), selectCurrentTools },
+                        };
+                    }
+                    catch (error) {
+                        (0, runtime_1.emitNervesEvent)({
+                            level: "warn", component: "heart", event: "heart.frontend_approval_authority_unavailable",
+                            message: "current approval authority could not be reconstructed; execution remains disabled",
+                            meta: { approvalId: record.approvalId, category: error instanceof Error ? error.name : "unknown" },
+                        });
+                        return null;
+                    }
+                };
+                let definition;
                 const terminal = await dependencies.executeApprovalDecision({
                     approvalStore: input.approvalStore,
                     checkpointStore: input.checkpointStore,
@@ -121,11 +167,36 @@ async function settleFrontendApproval(input, dependencies = DEFAULT_SETTLEMENT_D
                     },
                     ownerId: `frontend-decision-${dependencies.randomUUID()}`,
                     currentSessionRevision: currentRevision,
-                    resolveTool: dependencies.resolveToolDefinition,
-                    resolveApprovalPolicy: (name, args) => dependencies.approvalPolicyForInvocation(name, args, liveToolContext),
+                    resolveTool: async (name) => {
+                        const current = await currentOptions();
+                        definition = current ? dependencies.resolveToolDefinition(name, current.toolContext.toolSelection) : undefined;
+                        return definition;
+                    },
+                    resolveApprovalPolicy: async (name, args) => {
+                        const current = await currentOptions();
+                        return current ? dependencies.approvalPolicyForInvocation(name, args, current.toolContext) : { kind: "not_required" };
+                    },
                     liveGuard: async () => ({ ok: true }),
                     liveRisk: async () => ({ ok: true }),
-                    execute: (name, args) => dependencies.execTool(name, args, liveToolContext),
+                    preflight: async (context) => {
+                        const current = await currentOptions();
+                        if (!current)
+                            return { ok: false, reason: "current tool authority is unavailable" };
+                        const result = await dependencies.preflightToolCall(context.record.toolName, context.arguments, {
+                            ...current.toolContext,
+                            toolSelection: Object.freeze({ ordinary: Object.freeze([context.definition]), engine: Object.freeze([]) }),
+                        });
+                        return result.kind === "ready" ? { ok: true } : { ok: false, reason: result.text };
+                    },
+                    execute: async (name, args) => {
+                        const current = await currentOptions();
+                        if (!current || !definition)
+                            return { kind: "rejected_before_handler", text: "current approved tool authority is unavailable" };
+                        return dependencies.executeTool(name, args, {
+                            ...current.toolContext,
+                            toolSelection: Object.freeze({ ordinary: Object.freeze([definition]), engine: Object.freeze([]) }),
+                        });
+                    },
                 });
                 input.tokenStore.remove(record.approvalId);
                 const existing = dependencies.loadSession(record.sessionPath);
@@ -204,10 +275,13 @@ async function settleFrontendApproval(input, dependencies = DEFAULT_SETTLEMENT_D
                     },
                     runAgent: dependencies.runAgent,
                     runAgentOptions: {
-                        mcpManager,
                         toolContext: liveToolContext,
                         approvalCoordinator: nestedCoordinator,
                     },
+                    revalidate: async () => {
+                        const current = await currentOptions();
+                        return current ? { ...current, approvalCoordinator: nestedCoordinator } : null;
+                    },
                     persist,
                     deliver: async (text) => {
                         response = text;
@@ -242,8 +316,8 @@ async function settleFrontendApproval(input, dependencies = DEFAULT_SETTLEMENT_D
             });
         }
         finally {
-            if (input.request.runtimeMcpServers) {
-                await dependencies.releaseRuntimeMcpServers();
+            if (runtimeServers && !toolsDisabled) {
+                await dependencies.releaseRuntimeMcpServers(owner);
             }
         }
     });

package/dist/heart/identity.js

@@ -386,15 +386,27 @@ function validateFacingConfig(parsed, facingName, configFile) {
 }
 /**
  * Load and parse `<agentRoot>/agent.json`.
- * Reads the file fresh on each call unless an override is set.
+ * Reads the explicit owner's file fresh, or preserves the legacy ambient override when no owner is supplied.
  * If the config is v1, auto-migrates to v2 via migrateAgentConfigV1ToV2 and re-reads.
  * Throws descriptive error if file is missing or contains invalid JSON.
  */
-function loadAgentConfig() {
-    if (_agentConfigOverride) {
+function loadAgentConfig(owner) {
+    if (owner !== undefined && (typeof owner !== "object" || owner === null
+        || typeof owner.agentName !== "string" || owner.agentName.length === 0
+        || typeof owner.agentRoot !== "string" || !path.isAbsolute(owner.agentRoot))) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "config_identity.error",
+            component: "config/identity",
+            message: "invalid agent configuration owner",
+            meta: { reason: "explicit owner requires an agent name and absolute root" },
+        });
+        throw new Error("invalid agent configuration owner");
+    }
+    if (owner === undefined && _agentConfigOverride) {
         return _agentConfigOverride;
     }
-    const agentRoot = getAgentRoot();
+    const agentRoot = owner === undefined ? getAgentRoot() : owner.agentRoot;
     const configFile = path.join(agentRoot, "agent.json");
     let parsed = readAndParseAgentJson(configFile);
     // Inline migration: v1 -> v2
@@ -473,7 +485,7 @@ function loadAgentConfig() {
         enabled,
         humanFacing,
         agentFacing,
-        habitPaidTurnsPerDay: (0, autonomy_budget_1.normalizeHabitPaidTurnsPerDay)(getAgentName(), parsed.habitPaidTurnsPerDay, configFile),
+        habitPaidTurnsPerDay: (0, autonomy_budget_1.normalizeHabitPaidTurnsPerDay)(owner === undefined ? getAgentName() : owner.agentName, parsed.habitPaidTurnsPerDay, configFile),
         senses: normalizeSenses(parsed.senses, configFile),
         phrases: parsed.phrases,
     };

package/dist/heart/session-events.js

@@ -127,11 +127,18 @@ function materializeApprovalTerminal(input) {
     }
     const advanced = input.currentSessionRevision !== input.checkpoint.suspendedSessionRevision;
     if (advanced) {
+        const notice = input.record.state === "succeeded"
+            ? "the approved action completed, but the session changed; no model continuation was run"
+            : input.record.state === "failed"
+                ? "the approved action failed, but the session changed; no model continuation was run"
+                : input.record.state === "attempted_indeterminate"
+                    ? `${APPROVAL_TERMINAL_TEXT.attempted_indeterminate}; the session changed`
+                    : "the session changed before this approval could be applied; the protected action was not executed";
         return {
             messages,
             materialized: false,
             resumeProvider: false,
-            directNotice: "the session changed before this approval could be applied; the protected action was not executed",
+            directNotice: notice,
             revision: messagesRevision(messages),
         };
     }

package/dist/heart/tool-approval.js

@@ -5,6 +5,7 @@ exports.coordinateApprovalDecision = coordinateApprovalDecision;
 exports.digestApprovalSuspensionCheckpointPayload = digestApprovalSuspensionCheckpointPayload;
 exports.commitApprovalProposal = commitApprovalProposal;
 exports.recoverApprovalProposals = recoverApprovalProposals;
+exports.digestApprovalToolDefinition = digestApprovalToolDefinition;
 exports.executeApprovalDecision = executeApprovalDecision;
 exports.recoverClaimedApproval = recoverClaimedApproval;
 exports.recoverAttemptedApproval = recoverAttemptedApproval;
@@ -238,47 +239,65 @@ function terminalizeClaimed(store, claimed, state, reason) {
         reason,
     });
 }
-async function executeApprovalDecision(options) {
-    const decided = options.approvalStore.decide({ ...options.decision, ownerId: options.ownerId });
-    if (decided.state !== "claimed")
-        return decided;
-    await options.hooks?.afterClaim?.();
-    if (options.currentSessionRevision !== decided.suspendedSessionRevision) {
-        return terminalizeClaimed(options.approvalStore, decided, "session_head_changed", "suspended session revision changed");
-    }
-    const checkpoint = options.checkpointStore.read(decided.approvalId);
-    if (!checkpoint || !checkpointMatches(decided, checkpoint) || !frozenCallMatches(decided, checkpoint)) {
-        return terminalizeClaimed(options.approvalStore, decided, "drifted", "checkpoint evidence drift");
-    }
-    const definition = options.resolveTool(decided.toolName);
+function digestApprovalToolDefinition(definition, schemaDigest, policyId) {
+    const binding = definition.mcpBinding;
+    return (0, tool_arguments_1.digestJson)({
+        name: definition.tool.function.name, schemaDigest, policyId, advertisedTool: JSON.parse(JSON.stringify(definition.tool)),
+        ...(binding ? { mcp: {
+                agentName: binding.agentName, agentRoot: binding.agentRoot,
+                server: binding.server, rawName: binding.rawName, surfacedName: binding.surfacedName,
+                source: binding.source, pluginId: binding.pluginId ?? null,
+                configDigest: binding.configDigest,
+            } } : {}),
+    });
+}
+async function resolveApprovalTool(options, decided) {
+    const definition = await options.resolveTool(decided.toolName);
     if (!definition || definition.tool.function.name !== decided.toolName) {
-        return terminalizeClaimed(options.approvalStore, decided, "drifted", "tool identity drift");
+        return { ok: false, reason: "tool identity drift" };
     }
     const schema = definition.tool.function.parameters;
     if (!schema || typeof schema !== "object") {
-        return terminalizeClaimed(options.approvalStore, decided, "drifted", "advertised schema missing");
+        return { ok: false, reason: "advertised schema missing" };
     }
     const validated = (0, tool_arguments_1.validateAdvertisedToolArguments)(JSON.stringify(decided.arguments), schema);
     if (!validated.ok || validated.value.argumentDigest !== decided.argumentDigest
         || validated.value.schemaDigest !== decided.schemaDigest) {
-        return terminalizeClaimed(options.approvalStore, decided, "drifted", "tool arguments or schema drift");
+        return { ok: false, reason: "tool arguments or schema drift" };
     }
     const policy = await options.resolveApprovalPolicy?.(decided.toolName, validated.value.arguments)
         ?? definition.approvalPolicy?.(validated.value.arguments)
         ?? { kind: "not_required" };
     if (policy.kind !== "required") {
-        return terminalizeClaimed(options.approvalStore, decided, "drifted", "approval policy no longer requires approval");
+        return { ok: false, reason: "approval policy no longer requires approval" };
     }
-    const toolDigest = (0, tool_arguments_1.digestJson)({ name: decided.toolName, schemaDigest: validated.value.schemaDigest, policyId: policy.policyId });
+    const toolDigest = digestApprovalToolDefinition(definition, validated.value.schemaDigest, policy.policyId);
     const policyDigest = (0, tool_arguments_1.digestJson)({ policyId: policy.policyId, actionClass: policy.actionClass, classification: "required" });
     if (policy.policyId !== decided.policyId || toolDigest !== decided.toolDigest || policyDigest !== decided.policyDigest) {
-        return terminalizeClaimed(options.approvalStore, decided, "drifted", "approval policy or tool digest drift");
+        return { ok: false, reason: "approval policy or tool digest drift" };
     }
+    return { ok: true, definition, arguments: validated.value.arguments };
+}
+async function executeApprovalDecision(options) {
+    const decided = options.approvalStore.decide({ ...options.decision, ownerId: options.ownerId });
+    if (decided.state !== "claimed")
+        return decided;
+    await options.hooks?.afterClaim?.();
+    if (options.currentSessionRevision !== decided.suspendedSessionRevision) {
+        return terminalizeClaimed(options.approvalStore, decided, "session_head_changed", "suspended session revision changed");
+    }
+    const checkpoint = options.checkpointStore.read(decided.approvalId);
+    if (!checkpoint || !checkpointMatches(decided, checkpoint) || !frozenCallMatches(decided, checkpoint)) {
+        return terminalizeClaimed(options.approvalStore, decided, "drifted", "checkpoint evidence drift");
+    }
+    const current = await resolveApprovalTool(options, decided);
+    if (!current.ok)
+        return terminalizeClaimed(options.approvalStore, decided, "drifted", current.reason);
     const context = {
         record: structuredClone(decided),
         checkpoint: structuredClone(checkpoint),
-        definition,
-        arguments: structuredClone(validated.value.arguments),
+        definition: current.definition,
+        arguments: structuredClone(current.arguments),
     };
     const guard = await options.liveGuard(context);
     if (!guard.ok)
@@ -286,6 +305,14 @@ async function executeApprovalDecision(options) {
     const risk = await options.liveRisk(context);
     if (!risk.ok)
         return terminalizeClaimed(options.approvalStore, decided, "drifted", risk.reason);
+    const fresh = await resolveApprovalTool(options, decided);
+    if (!fresh.ok)
+        return terminalizeClaimed(options.approvalStore, decided, "drifted", fresh.reason);
+    const preflight = options.preflight
+        ? await options.preflight({ ...context, definition: fresh.definition, arguments: structuredClone(fresh.arguments) })
+        : { ok: false, reason: "canonical tool preflight is unavailable" };
+    if (!preflight.ok)
+        return terminalizeClaimed(options.approvalStore, decided, "drifted", preflight.reason);
     const attempted = options.approvalStore.markAttempted({
         approvalId: decided.approvalId,
         ownerId: decided.ownerId,
@@ -299,22 +326,28 @@ async function executeApprovalDecision(options) {
     catch (error) {
         if (!(error instanceof ApprovalExecutionFailedError))
             throw error;
-        await options.hooks?.afterHandler?.();
-        return options.approvalStore.complete({
-            approvalId: attempted.approvalId,
-            ownerId: attempted.ownerId,
-            epoch: attempted.epoch,
-            state: "failed",
-            result: `error: ${error.message}`,
-        });
+        result = { kind: "handler_failed", text: `error: ${error.message}`, error };
     }
+    if (!result || typeof result.text !== "string"
+        || !["rejected_before_handler", "handler_succeeded", "handler_failed", "handler_indeterminate"].includes(result.kind)) {
+        throw new ApprovalExecutionIndeterminateError("executor returned an invalid typed outcome; action was not retried");
+    }
+    const state = result.kind === "handler_succeeded" ? "succeeded"
+        : result.kind === "handler_indeterminate" ? "attempted_indeterminate" : "failed";
+    const emptyText = {
+        rejected_before_handler: "tool preflight rejected execution",
+        handler_succeeded: "action completed without output",
+        handler_failed: "action failed without details",
+        handler_indeterminate: "execution outcome is indeterminate; action was not retried",
+    };
+    const text = result.text.trim() ? result.text : emptyText[result.kind];
     await options.hooks?.afterHandler?.();
     return options.approvalStore.complete({
         approvalId: attempted.approvalId,
         ownerId: attempted.ownerId,
         epoch: attempted.epoch,
-        state: "succeeded",
-        result,
+        state,
+        result: result.kind === "rejected_before_handler" ? `no action was taken: ${text}` : text,
     });
 }
 function recoverClaimedApproval(options) {

package/dist/mind/pending.js

@@ -49,8 +49,8 @@ const node_crypto_1 = require("node:crypto");
 const identity_1 = require("../heart/identity");
 const session_events_1 = require("../heart/session-events");
 const runtime_1 = require("../nerves/runtime");
-function getPendingDir(agentName, friendId, channel, key) {
-    return path.join((0, identity_1.getAgentRoot)(agentName), "state", "pending", friendId, channel, key);
+function getPendingDir(agentName, friendId, channel, key, agentRoot = (0, identity_1.getAgentRoot)(agentName)) {
+    return path.join(agentRoot, "state", "pending", friendId, channel, key);
 }
 function getDeferredReturnDir(agentName, friendId) {
     return path.join((0, identity_1.getAgentRoot)(agentName), "state", "pending-returns", friendId);
@@ -58,8 +58,8 @@ function getDeferredReturnDir(agentName, friendId) {
 /** Canonical private-runtime pending path segments. The path is historical durable state. */
 exports.PRIVATE_RUNTIME_PENDING = { friendId: "self", channel: "inner", key: "dialog" };
 /** Returns the pending dir for this agent's private runtime. */
-function getPrivateRuntimePendingDir(agentName) {
-    return getPendingDir(agentName, exports.PRIVATE_RUNTIME_PENDING.friendId, exports.PRIVATE_RUNTIME_PENDING.channel, exports.PRIVATE_RUNTIME_PENDING.key);
+function getPrivateRuntimePendingDir(agentName, agentRoot) {
+    return getPendingDir(agentName, exports.PRIVATE_RUNTIME_PENDING.friendId, exports.PRIVATE_RUNTIME_PENDING.channel, exports.PRIVATE_RUNTIME_PENDING.key, agentRoot);
 }
 function hasPendingMessages(pendingDir) {
     if (!fs.existsSync(pendingDir))