@ouro.bot/cli 0.1.0-alpha.810 → 0.1.0-alpha.812

package/dist/repertoire/mcp-tools.js

@@ -4,10 +4,43 @@
  * so the model can call them directly without shell indirection.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpToolExecutionError = exports.McpCallRejectedError = void 0;
+exports.mcpToolSchema = mcpToolSchema;
 exports.mcpToolsAsDefinitions = mcpToolsAsDefinitions;
 const runtime_1 = require("../nerves/runtime");
+const tool_arguments_1 = require("./tool-arguments");
+class McpCallRejectedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "McpCallRejectedError";
+    }
+}
+exports.McpCallRejectedError = McpCallRejectedError;
+class McpToolExecutionError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+        this.name = "McpToolExecutionError";
+    }
+}
+exports.McpToolExecutionError = McpToolExecutionError;
+function mcpToolSchema(entry, tool) {
+    return {
+        type: "function",
+        function: {
+            name: entry.pluginId
+                ? `mcp__${entry.server}__${tool.name}`
+                : tool.name.startsWith(`${entry.server}_`) || tool.name === entry.server
+                    ? tool.name
+                    : `${entry.server}_${tool.name}`,
+            description: tool.description || `MCP tool: ${tool.name} (server: ${entry.server})`,
+            parameters: tool.inputSchema ?? { type: "object", properties: {} },
+        },
+    };
+}
 /**
- * Convert all tools from an McpManager into ToolDefinition objects.
+ * Convert an owned frozen MCP view into ToolDefinition objects.
  *
  * Naming rules:
  *  - Builtin servers (agent.json `mcpServers`) — legacy `{server}_{tool}`
@@ -18,33 +51,35 @@ const runtime_1 = require("../nerves/runtime");
  *    This matches Claude Code's external naming and the on-prompt promise
  *    in `desk-section.ts` (`mcp__desk__*`).
  *
- * The handler always calls `mcpManager.callTool()` with the un-prefixed
- * `(server, tool)` pair regardless of how the surfaced name was shaped.
+ * The handler carries the exact frozen binding to the manager's client fence.
  */
-function mcpToolsAsDefinitions(mcpManager) {
-    if (!mcpManager)
+function mcpToolsAsDefinitions(view) {
+    if (!view)
         return [];
-    return mcpManager.listAllTools().flatMap((entry) => {
-        const isPluginSourced = Boolean(entry.pluginId);
-        return entry.tools.map((tool) => ({
-            tool: {
-                type: "function",
-                function: {
-                    name: isPluginSourced
-                        ? `mcp__${entry.server}__${tool.name}`
-                        : tool.name.startsWith(`${entry.server}_`) || tool.name === entry.server
-                            ? tool.name
-                            : `${entry.server}_${tool.name}`,
-                    description: tool.description || `MCP tool: ${tool.name} (server: ${entry.server})`,
-                    parameters: tool.inputSchema ?? { type: "object", properties: {} },
-                },
-            },
+    return view.entries.flatMap((entry) => entry.tools.map((tool) => {
+        const schema = mcpToolSchema(entry, tool);
+        const binding = Object.freeze({
+            manager: view.manager, ...view.owner, server: entry.server,
+            rawName: tool.name, surfacedName: schema.function.name,
+            source: entry.source, pluginId: entry.pluginId,
+            configDigest: entry.configDigest, generation: entry.generation,
+            schemaDigest: (0, tool_arguments_1.digestJson)(schema),
+        });
+        return {
+            tool: schema,
             riskProfile: {
                 mutates: "external_side_effect",
                 risk: "high",
                 reason: "MCP tools may mutate external systems",
             },
-            handler: async (args) => {
+            handler: async (args, ctx) => {
+                if (ctx?.agentName !== binding.agentName || ctx.agentRoot !== binding.agentRoot) {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn", event: "mcp.tool_rejected", component: "repertoire",
+                        message: "MCP tool owner does not match its caller", meta: { reason: "owner mismatch" },
+                    });
+                    throw new McpCallRejectedError("MCP tool owner does not match its caller");
+                }
                 (0, runtime_1.emitNervesEvent)({
                     event: "mcp.tool_start",
                     component: "repertoire",
@@ -52,11 +87,14 @@ function mcpToolsAsDefinitions(mcpManager) {
                     meta: { server: entry.server, tool: tool.name },
                 });
                 try {
-                    const result = await mcpManager.callTool(entry.server, tool.name, args);
+                    const result = await view.manager.callTool(binding, args, { agentName: ctx.agentName, agentRoot: ctx.agentRoot });
                     const text = result.content
                         .filter((c) => c.type === "text" && c.text)
                         .map((c) => c.text)
                         .join("");
+                    if (result.isError === true) {
+                        throw new McpToolExecutionError("handler_failed", `[mcp error] ${entry.server}/${tool.name}: ${text}`);
+                    }
                     (0, runtime_1.emitNervesEvent)({
                         event: "mcp.tool_end",
                         component: "repertoire",
@@ -74,10 +112,13 @@ function mcpToolsAsDefinitions(mcpManager) {
                         message: `MCP tool ${entry.server}/${tool.name} failed: ${reason}`,
                         meta: { server: entry.server, tool: tool.name, reason },
                     });
-                    return `[mcp error] ${entry.server}/${tool.name}: ${reason}`;
+                    if (error instanceof McpCallRejectedError || error instanceof McpToolExecutionError)
+                        throw error;
+                    throw new McpToolExecutionError("handler_indeterminate", `[mcp error] ${entry.server}/${tool.name}: ${reason}`);
                 }
             },
             mcpServer: entry.server,
-        }));
-    });
+            mcpBinding: binding,
+        };
+    }));
 }

package/dist/repertoire/plugin-mcp.js

@@ -104,20 +104,20 @@ function readPluginMcpManifest(pluginRoot) {
  *
  * `homeDir` is an optional override for the `~/.ouro-cli/` root (test-only).
  */
-function listPluginMcpServers(homeDir) {
+function listPluginMcpServers(homeDir, owner) {
     (0, runtime_1.emitNervesEvent)({
         event: "plugin_mcp.list_start",
         component: "repertoire",
         message: "discovering plugin-declared MCP servers",
         meta: { operation: "listPluginMcpServers" },
     });
-    const config = (0, identity_1.loadAgentConfig)();
+    const config = owner === undefined ? (0, identity_1.loadAgentConfig)() : (0, identity_1.loadAgentConfig)(owner);
     const declaredPlugins = config.plugins ?? [];
     const pluginsRoot = (0, plugins_1.getPluginsRoot)(homeDir);
     // Per-agent override: DESK defaults to <bundleRoot>/desk/ when not explicitly set.
     const overrides = {};
     if (process.env.DESK === undefined) {
-        overrides.DESK = path.join((0, identity_1.getAgentRoot)(), "desk");
+        overrides.DESK = path.join(owner === undefined ? (0, identity_1.getAgentRoot)() : owner.agentRoot, "desk");
     }
     const out = [];
     for (const plugin of declaredPlugins) {

package/dist/repertoire/shell-sessions.js

@@ -11,12 +11,13 @@ const crypto_1 = require("crypto");
 const runtime_1 = require("../nerves/runtime");
 const sessions = new Map();
 const MAX_OUTPUT_LINES = 200;
-function spawnBackgroundShell(command) {
+function spawnBackgroundShell(command, owner) {
     const id = (0, crypto_1.randomUUID)();
     const proc = (0, child_process_1.spawn)("sh", ["-c", command], {
         stdio: ["pipe", "pipe", "pipe"],
     });
     const session = {
+        owner: Object.freeze({ ...owner }),
         process: proc,
         info: {
             id,
@@ -61,9 +62,9 @@ function spawnBackgroundShell(command) {
     });
     return { ...session.info };
 }
-function getShellSession(id) {
+function getShellSession(id, owner) {
     const session = sessions.get(id);
-    if (!session)
+    if (!session || session.owner.agentName !== owner.agentName || session.owner.agentRoot !== owner.agentRoot)
         return undefined;
     (0, runtime_1.emitNervesEvent)({
         component: "repertoire",
@@ -73,8 +74,8 @@ function getShellSession(id) {
     });
     return { ...session.info };
 }
-function listShellSessions() {
-    return Array.from(sessions.values()).map((s) => ({
+function listShellSessions(owner) {
+    return Array.from(sessions.values()).filter((session) => session.owner.agentName === owner.agentName && session.owner.agentRoot === owner.agentRoot).map((s) => ({
         id: s.info.id,
         command: s.info.command,
         status: s.info.status,
@@ -84,9 +85,9 @@ function listShellSessions() {
         output: [], // Don't include full output in listing
     }));
 }
-function tailShellSession(id, lines = 50) {
+function tailShellSession(id, owner, lines = 50) {
     const session = sessions.get(id);
-    if (!session)
+    if (!session || session.owner.agentName !== owner.agentName || session.owner.agentRoot !== owner.agentRoot)
         return undefined;
     const tail = session.info.output.slice(-lines);
     (0, runtime_1.emitNervesEvent)({

package/dist/repertoire/tool-arguments.js

@@ -3,18 +3,25 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertRelationshipToolOwner = assertRelationshipToolOwner;
 exports.digestJson = digestJson;
+exports.freezeToolValue = freezeToolValue;
 exports.validateAdvertisedToolArguments = validateAdvertisedToolArguments;
 const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
 const ajv_1 = __importDefault(require("ajv"));
 const runtime_1 = require("../nerves/runtime");
-const ajv = new ajv_1.default({
-    strict: true,
-    allErrors: true,
-    coerceTypes: false,
-    removeAdditional: false,
-    useDefaults: false,
-});
+function assertRelationshipToolOwner(ctx) {
+    if (ctx?.relationshipAuthorization && (typeof ctx.agentName !== "string" || ctx.agentName.length === 0
+        || typeof ctx.agentRoot !== "string" || !(0, node_path_1.isAbsolute)(ctx.agentRoot))) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn", component: "tools", event: "tool.owner_context_rejected",
+            message: "relationship-scoped tool has no valid explicit owner",
+            meta: { reason: "owner_coordinates_unavailable" },
+        });
+        throw new Error("an explicit owner name and absolute root are required for relationship-scoped tools");
+    }
+}
 const validators = new WeakMap();
 function unsupportedSchemaFeature(value, seen = new WeakSet()) {
     if (value === null)
@@ -65,6 +72,14 @@ function renderErrors(errors) {
 function digestJson(value) {
     return digest(canonicalize(value));
 }
+function freezeToolValue(value) {
+    if (value !== null && typeof value === "object") {
+        for (const child of Object.values(value))
+            freezeToolValue(child);
+        Object.freeze(value);
+    }
+    return value;
+}
 function validateAdvertisedToolArguments(rawArguments, schema) {
     const unsupported = unsupportedSchemaFeature(schema);
     if (unsupported) {
@@ -103,7 +118,14 @@ function validateAdvertisedToolArguments(rawArguments, schema) {
     }
     let validator = validators.get(schema);
     try {
-        validator ??= ajv.compile(schema);
+        // Each snapshot owns its compiler registry; only the weak cache is shared.
+        validator ??= new ajv_1.default({
+            strict: true,
+            allErrors: true,
+            coerceTypes: false,
+            removeAdditional: false,
+            useDefaults: false,
+        }).compile(schema);
         validators.set(schema, validator);
     }
     catch (error) {

package/dist/repertoire/tools-session.js

@@ -56,6 +56,7 @@ const obligations_1 = require("../arc/obligations");
 const progress_story_1 = require("../heart/progress-story");
 const habit_session_summary_1 = require("../heart/habits/habit-session-summary");
 const cross_chat_delivery_1 = require("../heart/cross-chat-delivery");
+const tool_arguments_1 = require("./tool-arguments");
 const mail_import_discovery_1 = require("../heart/mail-import-discovery");
 const outbound_1 = require("../senses/voice/outbound");
 const router_1 = require("../heart/external-events/router");
@@ -671,7 +672,7 @@ exports.sessionToolDefinitions = [
                 },
             },
         },
-        handler: (args) => {
+        handler: (args, ctx) => {
             const validation = validateSessionSummarySelector(args);
             if (!validation.ok) {
                 return JSON.stringify({
@@ -680,7 +681,8 @@ exports.sessionToolDefinitions = [
                     message: validation.message,
                 }, null, 2);
             }
-            const summary = (0, habit_session_summary_1.readHabitSessionSummary)((0, identity_1.getAgentRoot)(), validation.selector);
+            (0, tool_arguments_1.assertRelationshipToolOwner)(ctx);
+            const summary = (0, habit_session_summary_1.readHabitSessionSummary)(ctx?.agentRoot ?? (0, identity_1.getAgentRoot)(ctx?.agentName), validation.selector);
             if (!summary) {
                 return JSON.stringify({
                     kind: "not_found",
@@ -731,6 +733,14 @@ exports.sessionToolDefinitions = [
             const key = args.key || "session";
             const count = parseInt(args.messageCount || "20", 10);
             const mode = args.mode || "transcript";
+            if (!(0, config_1.isValidSessionCoordinate)(friendId) || !(0, config_1.isValidSessionCoordinate)(channel)) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn", component: "tools", event: "tool.session_path_rejected",
+                    message: "session query rejected invalid coordinates", meta: { reason: "invalid friend or channel" },
+                });
+                return NO_SESSION_FOUND_MESSAGE;
+            }
+            (0, tool_arguments_1.assertRelationshipToolOwner)(ctx);
             // Resolve friend name -> UUID if not already a UUID or "self"
             if (friendId && friendId !== "self" && !/^[0-9a-f]{8}-[0-9a-f]{4}-/.test(friendId) && ctx?.friendStore?.listAll) {
                 const allFriends = await ctx.friendStore.listAll();
@@ -743,8 +753,9 @@ exports.sessionToolDefinitions = [
                 if (friendId !== "self" || channel !== "inner") {
                     return "status mode is only available for self/private runtime.";
                 }
-                const sessionPath = (0, thoughts_1.getPrivateRuntimeSessionPath)((0, identity_1.getAgentRoot)());
-                const pendingDir = (0, pending_1.getPrivateRuntimePendingDir)((0, identity_1.getAgentName)());
+                const agentRoot = ctx?.agentRoot ?? (0, identity_1.getAgentRoot)(ctx?.agentName);
+                const sessionPath = (0, thoughts_1.getPrivateRuntimeSessionPath)(agentRoot);
+                const pendingDir = (0, pending_1.getPrivateRuntimePendingDir)(ctx?.agentName ?? (0, identity_1.getAgentName)(), agentRoot);
                 return renderInnerProgressStatus((0, thoughts_1.readPrivateRuntimeStatus)(sessionPath, pendingDir));
             }
             if (mode === "search") {
@@ -754,7 +765,21 @@ exports.sessionToolDefinitions = [
                     removalCycle: "alpha.616",
                 });
             }
-            const sessFile = (0, config_1.resolveSessionPath)(friendId, channel, key);
+            let sessFile;
+            try {
+                sessFile = (0, config_1.resolveSessionPath)(friendId, channel, key, {
+                    agentRoot: ctx?.agentRoot ?? (0, identity_1.getAgentRoot)(ctx?.agentName), confined: true,
+                });
+            }
+            catch (error) {
+                if (!(error instanceof config_1.InvalidSessionPathError))
+                    throw error;
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn", component: "tools", event: "tool.session_path_rejected",
+                    message: "session query rejected an unconfined path", meta: { reason: error.message },
+                });
+                return NO_SESSION_FOUND_MESSAGE;
+            }
             const sessionTail = await summarizeSessionTailSafely({
                 sessionPath: sessFile,
                 friendId,

package/dist/repertoire/tools-shell.js

@@ -5,13 +5,19 @@ const child_process_1 = require("child_process");
 const shell_sessions_1 = require("./shell-sessions");
 const identity_1 = require("../heart/identity");
 const runtime_1 = require("../nerves/runtime");
+const tool_arguments_1 = require("./tool-arguments");
+function shellOwner(ctx) {
+    (0, tool_arguments_1.assertRelationshipToolOwner)(ctx);
+    const agentName = ctx?.agentName ?? (0, identity_1.getAgentName)();
+    return { agentName, agentRoot: ctx?.agentRoot ?? (0, identity_1.getAgentRoot)(agentName) };
+}
 exports.shellToolDefinitions = [
     {
         tool: {
             type: "function",
             function: {
                 name: "shell",
-                description: "Run a shell command and return stdout/stderr. Working directory persists between calls. Use dedicated tools instead of shell when available: read_file instead of cat, edit_file instead of sed, glob instead of find, grep instead of grep/rg. Reserve shell for operations that genuinely need the shell: installing packages, running builds/tests, git operations, process management. Be careful with destructive commands -- consider reversibility before running. If a command fails, read the error output before retrying with a different approach.",
+                description: "Run a shell command and return stdout/stderr. Each call starts in the runtime's working directory; cd does not persist between calls. Use dedicated tools instead of shell when available: read_file instead of cat, edit_file instead of sed, glob instead of find, grep instead of grep/rg. Reserve shell for operations that genuinely need the shell: installing packages, running builds/tests, git operations, process management. Be careful with destructive commands -- consider reversibility before running. If a command fails, read the error output before retrying with a different approach.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -22,7 +28,7 @@ exports.shellToolDefinitions = [
                         },
                         background: {
                             type: "boolean",
-                            description: "Run in background. Returns immediately with a process ID. Use shell_status/shell_tail to monitor.",
+                            description: "Run in background and return immediately with a process ID. Records belong to the initiating agent and live only in process memory. Use separately authorized shell_status/shell_tail calls to monitor. Revocation does not kill a started process; runtime restart loses its record.",
                         },
                     },
                     required: ["command"],
@@ -42,7 +48,8 @@ exports.shellToolDefinitions = [
             }
             return { kind: "not_required" };
         },
-        handler: (a) => {
+        handler: (a, ctx) => {
+            (0, tool_arguments_1.assertRelationshipToolOwner)(ctx);
             // Destructive pattern detection (friction, not a block)
             const destructivePatterns = (0, shell_sessions_1.detectDestructivePatterns)(a.command);
             if (destructivePatterns.length > 0) {
@@ -55,17 +62,26 @@ exports.shellToolDefinitions = [
                 });
             }
             // Background mode: spawn and return immediately
-            if (a.background === "true") {
-                const session = (0, shell_sessions_1.spawnBackgroundShell)(a.command);
+            if (a.background === true) {
+                const session = (0, shell_sessions_1.spawnBackgroundShell)(a.command, shellOwner(ctx));
                 return JSON.stringify({ id: session.id, command: session.command, status: session.status });
             }
             const MAX_TIMEOUT = 600000;
             const requestedTimeout = Number(a.timeout_ms) || 0;
             let configDefault = 30000;
+            const owner = ctx?.agentName !== undefined || ctx?.agentRoot !== undefined ? shellOwner(ctx) : undefined;
             try {
-                configDefault = (0, identity_1.loadAgentConfig)().shell?.defaultTimeout ?? 30000;
+                configDefault = (0, identity_1.loadAgentConfig)(owner).shell?.defaultTimeout ?? 30000;
+            }
+            catch (error) {
+                if (owner)
+                    throw error;
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn", component: "tools", event: "tool.shell_config_unavailable",
+                    message: "legacy shell caller has no configuration; using the default timeout",
+                    meta: { fallbackTimeout: configDefault },
+                });
             }
-            catch { /* test env: no --agent flag */ }
             const baseTimeout = requestedTimeout > 0 ? requestedTimeout : configDefault;
             const timeout = Math.min(baseTimeout, MAX_TIMEOUT);
             const output = (0, child_process_1.execSync)(a.command, {
@@ -84,7 +100,7 @@ exports.shellToolDefinitions = [
             type: "function",
             function: {
                 name: "shell_status",
-                description: "Check status of background shell processes. Omit id to list all.",
+                description: "Check separately authorized status of background shell processes owned by this agent. Omit id to list this agent's records. Records live only in process memory; runtime restart loses observability, and revoked access does not kill a started process.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -93,11 +109,11 @@ exports.shellToolDefinitions = [
                 },
             },
         },
-        handler: (a) => {
+        handler: (a, ctx) => {
             if (!a.id) {
-                return JSON.stringify((0, shell_sessions_1.listShellSessions)());
+                return JSON.stringify((0, shell_sessions_1.listShellSessions)(shellOwner(ctx)));
             }
-            const session = (0, shell_sessions_1.getShellSession)(a.id);
+            const session = (0, shell_sessions_1.getShellSession)(a.id, shellOwner(ctx));
             if (!session)
                 return `process not found: ${a.id}`;
             return JSON.stringify(session);
@@ -109,7 +125,7 @@ exports.shellToolDefinitions = [
             type: "function",
             function: {
                 name: "shell_tail",
-                description: "Show recent output from a background shell process.",
+                description: "Show recent output from a background shell process owned by this agent. Access is reauthorized on each call. Revocation does not kill a started process, and runtime restart loses the in-memory record.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -119,11 +135,11 @@ exports.shellToolDefinitions = [
                 },
             },
         },
-        handler: (a) => {
+        handler: (a, ctx) => {
             /* v8 ignore next -- schema requires id, defensive guard @preserve */
             if (!a.id)
                 return "id is required";
-            const output = (0, shell_sessions_1.tailShellSession)(a.id);
+            const output = (0, shell_sessions_1.tailShellSession)(a.id, shellOwner(ctx));
             if (output === undefined)
                 return `process not found: ${a.id}`;
             return output || "(no output yet)";

package/dist/repertoire/tools-voice.js

@@ -98,12 +98,12 @@ exports.voiceToolDefinitions = [{
             const source = args.source === "url" || args.source === "file" || args.source === "tone"
                 ? args.source
                 : "tone";
-            const durationMs = typeof args.durationMs === "string" && args.durationMs.trim()
-                ? Number(args.durationMs)
-                : undefined;
-            const toneHz = typeof args.toneHz === "string" && args.toneHz.trim()
-                ? Number(args.toneHz)
-                : undefined;
+            const duration = args.durationMs;
+            const frequency = args.toneHz;
+            const durationMs = typeof duration === "number" ? duration
+                : typeof duration === "string" && duration.trim() ? Number(duration) : undefined;
+            const toneHz = typeof frequency === "number" ? frequency
+                : typeof frequency === "string" && frequency.trim() ? Number(frequency) : undefined;
             const request = {
                 source,
                 /* v8 ignore next -- sparse playback argument permutations are covered in the transport-level voice_play_audio tests @preserve */