@ouro.bot/cli 0.1.0-alpha.812 → 0.1.0-alpha.813
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/changelog.json
CHANGED
|
@@ -1,6 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
|
|
3
3
|
"versions": [
|
|
4
|
+
{
|
|
5
|
+
"version": "0.1.0-alpha.813",
|
|
6
|
+
"changes": [
|
|
7
|
+
"Unrelated logs no longer block Sanctuary containment checks; identity and authenticated audit safeguards remain intact."
|
|
8
|
+
]
|
|
9
|
+
},
|
|
4
10
|
{
|
|
5
11
|
"version": "0.1.0-alpha.812",
|
|
6
12
|
"changes": [
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
<?xml version="1.0"?>
|
|
2
2
|
<Container version="2">
|
|
3
3
|
<Name>ouro-butler</Name>
|
|
4
|
-
<Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.
|
|
4
|
+
<Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.813</Repository>
|
|
5
5
|
<Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
|
|
6
6
|
<Network>host</Network>
|
|
7
7
|
<Shell>sh</Shell>
|
|
@@ -1372,59 +1372,62 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
|
|
|
1372
1372
|
throw new Error("Telegram approval evidence MAC is invalid");
|
|
1373
1373
|
}
|
|
1374
1374
|
}
|
|
1375
|
-
|
|
1376
|
-
|
|
1377
|
-
|
|
1378
|
-
|
|
1379
|
-
|
|
1380
|
-
|
|
1381
|
-
|
|
1382
|
-
|
|
1383
|
-
|
|
1384
|
-
|
|
1385
|
-
|
|
1386
|
-
|
|
1387
|
-
|
|
1388
|
-
|
|
1389
|
-
|
|
1390
|
-
|
|
1391
|
-
|
|
1392
|
-
|| relativePath.startsWith(`state${path.sep}sessions${path.sep}`)
|
|
1393
|
-
|| relativePath.startsWith(`state${path.sep}pending${path.sep}`)
|
|
1394
|
-
|| relativePath.startsWith(`state${path.sep}pending-returns${path.sep}`)))).digest("hex");
|
|
1395
|
-
const friendSurfaceDigest = (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(surfacePairs.filter(({ relativePath }) => relativePath.startsWith(`friends${path.sep}`)))).digest("hex");
|
|
1396
|
-
const canonicalFriendCount = surfacePairs.reduce((count, { relativePath, raw }) => {
|
|
1397
|
-
if (!relativePath.startsWith(`friends${path.sep}`) || !relativePath.endsWith(".json"))
|
|
1398
|
-
return count;
|
|
1399
|
-
const record = object(JSON.parse(raw), "Telegram Friend identity");
|
|
1400
|
-
if (!Array.isArray(record.externalIds))
|
|
1401
|
-
return count;
|
|
1402
|
-
return count + record.externalIds.filter((value) => {
|
|
1403
|
-
const identity = object(value, "Telegram Friend external identity");
|
|
1404
|
-
return identity.provider === "telegram-user" && identity.externalId === expectedSubject;
|
|
1375
|
+
// Unknown admission needs the same surfaces for its zero-work digest.
|
|
1376
|
+
if (sanctuary_acceptance_harness_1.SANCTUARY_SCENARIO_SOURCES[label].includes("identity-surface-audit") || label === "unit-16d-2-unknown-admission") {
|
|
1377
|
+
const expectedSubject = (0, telegram_1.opaqueTelegramSubject)(identityKey, credentials.botToken, credentials.authorizedUserId, credentials.authorizedChatId);
|
|
1378
|
+
const observedSubjects = auditEntries.flatMap((entry) => typeof entry.meta.subject === "string" ? [entry.meta.subject] : []);
|
|
1379
|
+
const approvalSubjects = approvalRecords.map((projection) => projection.approval).filter((record) => record.transport === "telegram").map((record) => record.requesterId);
|
|
1380
|
+
const rawValues = [...new Set([credentials.botToken, credentials.authorizedUserId, credentials.authorizedChatId])];
|
|
1381
|
+
const persistedIdentitySurfaces = readBoundedIdentitySurfaces(agentRoot);
|
|
1382
|
+
const surfacePairs = Array.from({ length: Math.floor(persistedIdentitySurfaces.length / 2) }, (_, index) => ({
|
|
1383
|
+
relativePath: persistedIdentitySurfaces[index * 2],
|
|
1384
|
+
raw: persistedIdentitySurfaces[index * 2 + 1],
|
|
1385
|
+
}));
|
|
1386
|
+
const canonicalSessionPath = path.join("state", "sessions", `telegram-user:${expectedSubject}`, "telegram", `telegram_${expectedSubject}.json`);
|
|
1387
|
+
const canonicalSessionCount = surfacePairs.filter(({ relativePath, raw }) => {
|
|
1388
|
+
if (relativePath !== canonicalSessionPath)
|
|
1389
|
+
return false;
|
|
1390
|
+
object(JSON.parse(raw), "canonical Telegram session");
|
|
1391
|
+
return true;
|
|
1405
1392
|
}).length;
|
|
1406
|
-
|
|
1407
|
-
|
|
1408
|
-
|
|
1409
|
-
|
|
1410
|
-
|
|
1411
|
-
|
|
1412
|
-
|
|
1413
|
-
|
|
1414
|
-
|
|
1415
|
-
|
|
1416
|
-
|
|
1417
|
-
|
|
1418
|
-
|
|
1419
|
-
|
|
1420
|
-
|
|
1421
|
-
|
|
1422
|
-
|
|
1423
|
-
|
|
1424
|
-
|
|
1425
|
-
|
|
1426
|
-
|
|
1427
|
-
|
|
1393
|
+
const sessionSurfaceDigest = (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(surfacePairs.filter(({ relativePath }) => relativePath === path.join("state", "senses", "telegram", "identity-subjects.json")
|
|
1394
|
+
|| relativePath.startsWith(`state${path.sep}sessions${path.sep}`)
|
|
1395
|
+
|| relativePath.startsWith(`state${path.sep}pending${path.sep}`)
|
|
1396
|
+
|| relativePath.startsWith(`state${path.sep}pending-returns${path.sep}`)))).digest("hex");
|
|
1397
|
+
const friendSurfaceDigest = (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(surfacePairs.filter(({ relativePath }) => relativePath.startsWith(`friends${path.sep}`)))).digest("hex");
|
|
1398
|
+
const canonicalFriendCount = surfacePairs.reduce((count, { relativePath, raw }) => {
|
|
1399
|
+
if (!relativePath.startsWith(`friends${path.sep}`) || !relativePath.endsWith(".json"))
|
|
1400
|
+
return count;
|
|
1401
|
+
const record = object(JSON.parse(raw), "Telegram Friend identity");
|
|
1402
|
+
if (!Array.isArray(record.externalIds))
|
|
1403
|
+
return count;
|
|
1404
|
+
return count + record.externalIds.filter((value) => {
|
|
1405
|
+
const identity = object(value, "Telegram Friend external identity");
|
|
1406
|
+
return identity.provider === "telegram-user" && identity.externalId === expectedSubject;
|
|
1407
|
+
}).length;
|
|
1408
|
+
}, 0);
|
|
1409
|
+
const surfaceRecords = [...persistedIdentitySurfaces, auditRaw ?? "", auditHeadRaw ?? "", JSON.stringify(approvalRecords)];
|
|
1410
|
+
const surfaceSubjects = surfaceRecords.flatMap((raw) => raw.match(/tg_[A-Za-z0-9_-]{43}/gu) ?? []);
|
|
1411
|
+
const structuredRawId = /"(?:authorizedUserId|authorizedChatId|transportUserId|transportChatId|userId|chatId|updateId|messageId)"\s*:\s*"?\d{1,20}"?/gu;
|
|
1412
|
+
const rawLeakCount = surfaceRecords.reduce((count, raw) => count + rawValues.filter((value) => raw.includes(value)).length + (raw.match(structuredRawId)?.length ?? 0), 0);
|
|
1413
|
+
const mismatchCount = [...surfaceSubjects, ...observedSubjects, ...approvalSubjects].filter((subject) => subject !== expectedSubject).length;
|
|
1414
|
+
identity = {
|
|
1415
|
+
keyPresent: true,
|
|
1416
|
+
subjectOpaque: /^tg_[A-Za-z0-9_-]{43}$/u.test(expectedSubject)
|
|
1417
|
+
&& mismatchCount === 0,
|
|
1418
|
+
rawIdentityAbsent: rawLeakCount === 0,
|
|
1419
|
+
liveSubjectObserved: observedSubjects.includes(expectedSubject) && telegramTurns.some((turn) => turn.status === "success"),
|
|
1420
|
+
inspectedRecordCount: surfaceRecords.length,
|
|
1421
|
+
opaqueSubjectCount: [...surfaceSubjects, ...observedSubjects, ...approvalSubjects].filter((subject) => subject === expectedSubject).length,
|
|
1422
|
+
mismatchCount,
|
|
1423
|
+
rawLeakCount,
|
|
1424
|
+
canonicalSessionCount,
|
|
1425
|
+
canonicalFriendCount,
|
|
1426
|
+
sessionSurfaceDigest,
|
|
1427
|
+
friendSurfaceDigest,
|
|
1428
|
+
surfaceDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(surfaceRecords)).digest("hex"),
|
|
1429
|
+
};
|
|
1430
|
+
}
|
|
1428
1431
|
}
|
|
1429
1432
|
const container = options.skipContainerSnapshot === true
|
|
1430
1433
|
? null
|
package/npm-shrinkwrap.json
CHANGED
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ouro.bot/cli",
|
|
3
|
-
"version": "0.1.0-alpha.
|
|
3
|
+
"version": "0.1.0-alpha.813",
|
|
4
4
|
"lockfileVersion": 3,
|
|
5
5
|
"requires": true,
|
|
6
6
|
"packages": {
|
|
7
7
|
"": {
|
|
8
8
|
"name": "@ouro.bot/cli",
|
|
9
|
-
"version": "0.1.0-alpha.
|
|
9
|
+
"version": "0.1.0-alpha.813",
|
|
10
10
|
"dependencies": {
|
|
11
11
|
"@anthropic-ai/sdk": "^0.78.0",
|
|
12
12
|
"@azure/identity": "^4.13.0",
|