@ouro.bot/cli 0.1.0-alpha.814 → 0.1.0-alpha.816

package/dist/senses/sanctuary-interactive-control.js

@@ -229,70 +229,174 @@ function createSanctuaryInteractiveControl(options) {
     const socketPath = path.join(options.agentRoot, "state", "acceptance", "telegram-control.sock");
     const runRequest = options.runRequest ?? (async (operation) => operation());
     let server;
+    let endpoint;
+    let startPromise;
+    let stopPromise;
     let updateId = 2_100_000_000;
+    const readEndpoint = () => (0, node_fs_1.lstatSync)(socketPath, { bigint: true, throwIfNoEntry: false });
+    // Socket mtime, unlike ctime, survives permission-only changes.
+    const matches = (observed, current) => current !== undefined && current.isSocket() && current.dev === observed.dev && current.ino === observed.ino
+        && current.birthtimeNs === observed.birthtimeNs && current.mtimeNs === observed.mtimeNs;
+    const stopListener = async () => {
+        const active = server;
+        if (!active)
+            return;
+        if (active.listening) {
+            const current = readEndpoint();
+            // Native Server.close() also unlinks its pathname, so ownership must precede it.
+            if (current && (!endpoint || !matches(endpoint, current)))
+                throw new Error("Sanctuary interactive control socket ownership was replaced");
+            await new Promise((resolve, reject) => active.close((error) => error ? reject(error) : resolve()));
+        }
+        server = undefined;
+        endpoint = undefined;
+    };
     return {
         socketPath,
-        async start() {
-            if (server)
-                return;
-            (0, node_fs_1.mkdirSync)(path.dirname(socketPath), { recursive: true, mode: 0o700 });
-            if ((0, node_fs_1.existsSync)(socketPath))
-                (0, node_fs_1.unlinkSync)(socketPath);
-            server = (0, node_net_1.createServer)({ allowHalfOpen: true }, (connection) => {
-                let raw = "";
-                connection.setEncoding("utf8");
-                connection.on("error", () => undefined);
-                connection.on("data", (chunk) => { raw += chunk; if (Buffer.byteLength(raw) > MAX_CONTROL_REQUEST)
-                    connection.destroy(); });
-                connection.on("end", () => {
-                    void runRequest(async () => {
+        start() {
+            if (startPromise)
+                return startPromise;
+            const previousStop = stopPromise;
+            stopPromise = undefined;
+            const starting = (async () => {
+                if (previousStop)
+                    await previousStop;
+                if (server) {
+                    if (endpoint && matches(endpoint, readEndpoint()))
+                        return;
+                    await stopListener();
+                }
+                (0, node_fs_1.mkdirSync)(path.dirname(socketPath), { recursive: true, mode: 0o700 });
+                const previous = readEndpoint();
+                if (previous) {
+                    if (!previous.isSocket())
+                        throw new Error("Sanctuary interactive control endpoint is not a socket");
+                    await new Promise((resolve, reject) => {
+                        const socket = (0, node_net_1.createConnection)(socketPath);
+                        const finish = (error) => { socket.destroy(); if (error)
+                            reject(error);
+                        else
+                            resolve(); };
+                        socket.setTimeout(1_000, () => finish(new Error("Sanctuary interactive control ownership probe timed out")));
+                        socket.once("connect", () => finish(new Error("Sanctuary interactive control endpoint has another live listener")));
+                        socket.once("error", (error) => finish(error.code === "ECONNREFUSED" ? undefined : error));
+                    });
+                    const current = readEndpoint();
+                    if (!matches(previous, current) || current.ctimeNs !== previous.ctimeNs)
+                        throw new Error("Sanctuary interactive control endpoint was replaced during the ownership probe");
+                    (0, node_fs_1.unlinkSync)(socketPath);
+                }
+                server = (0, node_net_1.createServer)({ allowHalfOpen: true }, (connection) => {
+                    let raw = "";
+                    connection.setEncoding("utf8");
+                    connection.on("error", () => undefined);
+                    connection.on("data", (chunk) => { raw += chunk; if (Buffer.byteLength(raw) > MAX_CONTROL_REQUEST)
+                        connection.destroy(); });
+                    connection.on("end", () => {
+                        void runRequest(async () => {
+                            try {
+                                (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_interactive_control_request", message: "Sanctuary interactive control request received", meta: { bytes: Buffer.byteLength(raw) } });
+                                const parsed = object(JSON.parse(raw), "interactive control request");
+                                if (parsed.operation === "interactive_runtime_ready") {
+                                    exactKeys(parsed, ["operation", "label", "scenarioHandleDigest"], "interactive readiness request");
+                                    if (parsed.label !== "unit-16m-restart-continuation" || typeof parsed.scenarioHandleDigest !== "string" || !SHA256.test(parsed.scenarioHandleDigest))
+                                        throw new Error("interactive readiness binding is invalid");
+                                    connection.end(`${JSON.stringify({ ok: true, result: { ready: true } })}\n`);
+                                    return;
+                                }
+                                const result = await executeSanctuaryInteractiveEngine(parsed, {
+                                    agentRoot: options.agentRoot,
+                                    readApprovals: (digest) => (0, approval_store_1.readApprovalsByScenarioHandleDigest)(path.join(options.agentRoot, "state", "approvals", "approvals.sqlite"), digest),
+                                    readPending: () => new telegram_client_1.FileTelegramPendingApprovalStore(path.join(options.agentRoot, "state", "approvals", "telegram-pending.json")).load(),
+                                    createSession: async () => ({
+                                        handle: ({ callbackData, queryId, messageId }) => runRequest(() => options.transport.handleUpdate({
+                                            update_id: updateId++,
+                                            callback_query: {
+                                                id: queryId,
+                                                from: { id: Number(options.authorizedUserId) },
+                                                data: callbackData,
+                                                message: {
+                                                    message_id: Number(messageId),
+                                                    chat: { id: Number(options.authorizedChatId) },
+                                                },
+                                            },
+                                        })),
+                                        pendingApprovalIds: () => options.transport.listPendingDeliveries().map(({ approvalId }) => approvalId),
+                                        close: () => undefined,
+                                    }),
+                                    proveIndeterminateRecovery: (approval, digest) => proveSanctuaryAttemptedRecoveryWithoutRetry(options.agentRoot, digest, approval),
+                                    writeCredentialObserved: () => /credential|api[_-]?key|token|secret/iu.test(raw),
+                                });
+                                connection.end(`${JSON.stringify({ ok: true, result })}\n`);
+                            }
+                            catch {
+                                connection.end(`${JSON.stringify({ ok: false, error: "interactive runtime operation failed" })}\n`);
+                            }
+                        }).catch(() => { if (!connection.destroyed)
+                            connection.end(`${JSON.stringify({ ok: false, error: "interactive runtime operation failed" })}\n`); });
+                    });
+                });
+                const active = server;
+                try {
+                    await new Promise((resolve, reject) => {
+                        const onError = (error) => { active.off("listening", onListening); reject(error); };
+                        const onListening = () => {
+                            active.off("error", onError);
+                            try {
+                                if (!endpoint || !matches(endpoint, readEndpoint()))
+                                    throw new Error("Sanctuary interactive control socket ownership was replaced during startup");
+                                resolve();
+                            }
+                            catch (error) {
+                                reject(error);
+                            }
+                        };
+                        active.once("error", onError);
+                        active.once("listening", onListening);
                         try {
-                            (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_interactive_control_request", message: "Sanctuary interactive control request received", meta: { bytes: Buffer.byteLength(raw) } });
-                            const parsed = object(JSON.parse(raw), "interactive control request");
-                            if (parsed.operation === "interactive_runtime_ready") {
-                                exactKeys(parsed, ["operation", "label", "scenarioHandleDigest"], "interactive readiness request");
-                                if (parsed.label !== "unit-16m-restart-continuation" || typeof parsed.scenarioHandleDigest !== "string" || !SHA256.test(parsed.scenarioHandleDigest))
-                                    throw new Error("interactive readiness binding is invalid");
-                                connection.end(`${JSON.stringify({ ok: true, result: { ready: true } })}\n`);
-                                return;
+                            active.listen(socketPath);
+                            if (active.listening) {
+                                endpoint = readEndpoint();
+                                if (!endpoint?.isSocket())
+                                    throw new Error("Sanctuary interactive control startup ownership is unproven");
+                                (0, node_fs_1.chmodSync)(socketPath, 0o600);
+                                endpoint = readEndpoint();
                             }
-                            const result = await executeSanctuaryInteractiveEngine(parsed, {
-                                agentRoot: options.agentRoot,
-                                readApprovals: (digest) => (0, approval_store_1.readApprovalsByScenarioHandleDigest)(path.join(options.agentRoot, "state", "approvals", "approvals.sqlite"), digest),
-                                readPending: () => new telegram_client_1.FileTelegramPendingApprovalStore(path.join(options.agentRoot, "state", "approvals", "telegram-pending.json")).load(),
-                                createSession: async () => ({
-                                    handle: ({ callbackData, queryId, messageId }) => runRequest(() => options.transport.handleUpdate({
-                                        update_id: updateId++,
-                                        callback_query: {
-                                            id: queryId,
-                                            from: { id: Number(options.authorizedUserId) },
-                                            data: callbackData,
-                                            message: {
-                                                message_id: Number(messageId),
-                                                chat: { id: Number(options.authorizedChatId) },
-                                            },
-                                        },
-                                    })),
-                                    pendingApprovalIds: () => options.transport.listPendingDeliveries().map(({ approvalId }) => approvalId),
-                                    close: () => undefined,
-                                }),
-                                proveIndeterminateRecovery: (approval, digest) => proveSanctuaryAttemptedRecoveryWithoutRetry(options.agentRoot, digest, approval),
-                                writeCredentialObserved: () => /credential|api[_-]?key|token|secret/iu.test(raw),
-                            });
-                            connection.end(`${JSON.stringify({ ok: true, result })}\n`);
                         }
-                        catch {
-                            connection.end(`${JSON.stringify({ ok: false, error: "interactive runtime operation failed" })}\n`);
+                        catch (error) {
+                            active.off("error", onError);
+                            onError(error);
                         }
-                    }).catch(() => { if (!connection.destroyed)
-                        connection.end(`${JSON.stringify({ ok: false, error: "interactive runtime operation failed" })}\n`); });
-                });
-            });
-            await new Promise((resolve, reject) => { server.once("error", reject); server.listen(socketPath, () => { server.off("error", reject); (0, node_fs_1.chmodSync)(socketPath, 0o600); resolve(); }); });
+                    });
+                }
+                catch (error) {
+                    try {
+                        await stopListener();
+                    }
+                    catch (cleanupError) {
+                        throw new AggregateError([error, cleanupError], "Sanctuary interactive control startup and ownership cleanup failed");
+                    }
+                    throw error;
+                }
+            })().finally(() => { if (startPromise === starting)
+                startPromise = undefined; });
+            startPromise = starting;
+            return starting;
+        },
+        stop() {
+            if (stopPromise)
+                return stopPromise;
+            const starting = startPromise;
+            startPromise = undefined;
+            const stopping = (async () => {
+                if (starting)
+                    await starting;
+                await stopListener();
+            })().finally(() => { if (stopPromise === stopping)
+                stopPromise = undefined; });
+            stopPromise = stopping;
+            return stopping;
         },
-        async stop() { const active = server; server = undefined; if (active)
-            await new Promise((resolve) => active.close(() => resolve())); if ((0, node_fs_1.existsSync)(socketPath))
-            (0, node_fs_1.unlinkSync)(socketPath); },
     };
 }
 async function sanctuaryInteractiveControlReady(socketPath, timeoutMs = 1_000) {

package/dist/senses/sanctuary-media-catalog-contract.js

@@ -132,7 +132,10 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
     const mentionsMedia = /\b(?:film|films|movie|movies|shows|tv|jellyfin|watch|shelf|stock|catalog|library|lib)\b/u.test(normalized);
     const asksCatalog = /\b(?:have|got|stock|catalog|library|lib|shelf|jellyfin|favorite|favourite|recommend|suggest|pick|watch|add|see|show|list|browse|access)\b/u.test(normalized);
     const requestedTitleQuery = requestedTitle(normalized);
-    if ((!mentionsMedia && !requestedTitleQuery) || !asksCatalog)
+    const operationalOnly = /\b(?:restart|reboot|start|stop|stopped|stopping|running|down|investigate|redeploy|deploy|crash|crashed)\b/u.test(normalized)
+        && !requestedTitleQuery
+        && !/\b(?:film|films|movie|movies|shows|tv|watch|shelf|stock|catalog|library|lib|have|got|favorite|favourite|recommend|suggest|pick|add|see|show|list|browse|access|find|search|count|contents)\b/u.test(normalized);
+    if (operationalOnly || (!mentionsMedia && !requestedTitleQuery) || !asksCatalog)
         return undefined;
     const kind = requestKind(normalized, requestedTitleQuery);
     const asksForAddition = /\b(?:add|missing from|must get)\b/u.test(normalized);

package/dist/senses/sanctuary-runtime.js

@@ -274,6 +274,8 @@ function createSanctuaryToolContext(agentName) {
         acceptanceApproval: sanctuary_acceptance_marker_1.readSanctuaryAcceptanceApproval,
         reserveRoutineAction: (input) => (0, steward_policy_1.consumeRoutineActionGrant)(agentRoot, input),
         transitionRoutineAction: (input) => (0, steward_policy_1.transitionRoutineActionReceipt)(agentRoot, input),
+        withRoutineActionAttempt: (reservation, validate, attempt) => (0, steward_policy_1.withRoutineActionAttempt)(agentRoot, reservation, validate, attempt),
+        withApprovalPolicyLease: (operation) => (0, steward_policy_1.withStewardPolicyLease)(agentRoot, operation),
     });
     return {
         agentRoot,

package/dist/senses/telegram-approval-runtime.js

@@ -52,9 +52,11 @@ const sanctuary_acceptance_marker_1 = require("../heart/daemon/sanctuary-accepta
 const telegram_1 = require("./telegram");
 const context_1 = require("../mind/context");
 const session_transaction_1 = require("../mind/session-transaction");
+const relationship_authorization_1 = require("../repertoire/relationship-authorization");
 const tools_1 = require("../repertoire/tools");
 const mcp_manager_1 = require("../repertoire/mcp-manager");
 const runtime_1 = require("../nerves/runtime");
+const shared_turn_1 = require("./shared-turn");
 const telegram_client_1 = require("./telegram-client");
 function telegramApprovalCommitBarrierHooks(effectBarrier) {
     return {
@@ -190,11 +192,11 @@ function createTelegramApprovalRuntime(options) {
     const resolveTool = options.dependencies?.resolveTool ?? tools_1.resolveToolDefinition;
     const agentRoot = options.dependencies?.agentRoot ?? (0, identity_1.getAgentRoot)(options.agentName);
     const owner = Object.freeze({ agentName: options.agentName, agentRoot });
-    const currentOptions = async (record) => {
+    const currentOptions = async (record, phase) => {
         try {
             if (!options.resolveLiveToolContext)
                 throw new Error("current owner authority producer is unavailable");
-            const context = await options.resolveLiveToolContext(record);
+            let context = await options.resolveLiveToolContext(record);
             const relationship = context.relationshipAuthorization;
             if (context.agentName !== owner.agentName || context.agentRoot !== owner.agentRoot
                 || relationship?.profileId !== "sanctuary-owner" || relationship.actor?.trustLevel !== "family"
@@ -203,6 +205,26 @@ function createTelegramApprovalRuntime(options) {
                 || context.currentSession.key !== record.sessionKey || context.currentSession.sessionPath !== record.sessionPath) {
                 throw new Error("current approval owner coordinates are not exact");
             }
+            if (record.toolName === "unraid_restart_container") {
+                const restartOwner = await resolveRestartOwnerContext(record, context);
+                if (restartOwner.allowed) {
+                    context = restartOwner.context;
+                }
+                else {
+                    const { reason } = restartOwner;
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn", component: "senses", event: "senses.telegram_approval_owner_denied",
+                        message: "restart approval owner revalidation failed",
+                        meta: { approvalId: record.approvalId, reason, phase },
+                    });
+                    if (phase === "decision")
+                        return null;
+                    context = {
+                        ...context,
+                        relationshipAuthorization: { authorizedContextScopes: [], advertisedToolNames: [], authorizeTool: () => ({ allowed: false, reason }) },
+                    };
+                }
+            }
             const runtime = await (options.dependencies?.getProviderRuntime ?? core_1.getProviderRuntime)("human", owner);
             const mcpManager = await (options.dependencies?.getSharedMcpManager ?? mcp_manager_1.getSharedMcpManager)(owner) ?? undefined;
             const selectCurrentTools = () => (0, tools_1.selectToolsForChannel)((0, friends_1.getChannelCapabilities)("telegram"), context.context?.friend.toolPreferences, context.context, runtime.capabilities, mcpManager, runtime.model, context);
@@ -220,9 +242,10 @@ function createTelegramApprovalRuntime(options) {
             return null;
         }
     };
-    const invocationContext = (current, definition) => ({
+    const invocationContext = (current, definition, restartApproval) => ({
         ...current.toolContext,
         toolSelection: Object.freeze({ ordinary: Object.freeze([definition]), engine: Object.freeze([]) }),
+        ...(restartApproval ? { restartApproval } : {}),
     });
     const stateRoot = path.join(agentRoot, "state", "approvals");
     const store = (0, approval_store_1.openApprovalStore)({ databasePath: path.join(stateRoot, "approvals.sqlite"), now: () => new Date(now()) });
@@ -230,6 +253,44 @@ function createTelegramApprovalRuntime(options) {
     const tokens = new approval_files_1.FileApprovalTokenStore(path.join(stateRoot, "tokens.json"));
     const pendingStore = new telegram_client_1.FileTelegramPendingApprovalStore(path.join(stateRoot, "telegram-pending.json"));
     let transport;
+    const ownerSessionMatches = (binding, sessionPath) => {
+        if (binding.sessionKey !== `telegram:${options.subject}`
+            || sessionPath !== (0, shared_turn_1.getSenseSessionPath)(options.agentName, binding.friendId, "telegram", binding.sessionKey, agentRoot))
+            return false;
+        const envelope = (0, session_events_1.loadSessionEnvelopeFile)(sessionPath);
+        const latestUser = envelope && (0, session_events_1.selectEffectiveSessionEvents)(envelope.events).findLast((event) => event.role === "user");
+        return latestUser?.id === binding.sessionEventId && latestUser.relations.references.includes(binding.requestId);
+    };
+    const resolveRestartOwnerContext = async (record, currentContext) => {
+        const resolve = options.resolveOwnerRelationship;
+        const binding = record.ownerBinding && Object.freeze({ ...record.ownerBinding });
+        if (!binding || !resolve || (options.toolContext.agentRoot ?? agentRoot) !== agentRoot || record.sessionKey !== binding.sessionKey) {
+            return { allowed: false, reason: "restart approval owner binding is unavailable" };
+        }
+        try {
+            if (!ownerSessionMatches(binding, record.sessionPath))
+                return { allowed: false, reason: "restart approval owner session changed" };
+            const relationship = await resolve(binding);
+            const context = {
+                ...currentContext,
+                relationshipAuthorization: {
+                    ...relationship,
+                    requestId: binding.requestId,
+                    authorizeTool: async (name, args) => {
+                        const current = await resolve(binding);
+                        if (!ownerSessionMatches(binding, record.sessionPath))
+                            return { allowed: false, reason: "restart approval owner session changed" };
+                        return current.authorizeTool(name, args);
+                    },
+                },
+            };
+            const authorization = await (0, relationship_authorization_1.authorizeRestartApprovalRequester)(context, record.arguments, binding);
+            return authorization.allowed ? { allowed: true, context } : authorization;
+        }
+        catch {
+            return { allowed: false, reason: "restart approval owner authorization is unavailable" };
+        }
+    };
     const commitAcceptanceEvidence = options.dependencies?.commitAcceptanceEvidence ?? (async (event, meta) => {
         if (event === "telegram.callback_settled") {
             await (0, runtime_1.emitNervesEventDurable)({
@@ -256,6 +317,25 @@ function createTelegramApprovalRuntime(options) {
             if (request.toolCall.type !== "function")
                 throw new Error("approval requires a function tool call");
             effectBarrier();
+            let ownerBinding;
+            if (request.toolCall.function.name === "unraid_restart_container") {
+                const live = request.liveToolContext;
+                const authorization = await (0, relationship_authorization_1.authorizeRoutineActionRequester)(live, request.arguments);
+                if (!authorization.allowed || authorization.requester.kind !== "owner"
+                    || live?.agentRoot !== agentRoot || live.currentSession?.sessionPath !== context.sessionPath) {
+                    throw new Error("restart approval requires a current owner request");
+                }
+                const requester = authorization.requester;
+                ownerBinding = {
+                    friendId: requester.friendId, requestId: requester.requestId, sessionEventId: requester.sessionEventId,
+                    sessionKey: requester.origin.key, profileVersion: authorization.profileVersion,
+                };
+                if (!ownerSessionMatches(ownerBinding, context.sessionPath))
+                    throw new Error("restart approval owner session changed");
+                const policy = await (0, tools_1.approvalPolicyForInvocation)("unraid_restart_container", request.arguments, live);
+                if (policy.kind !== "required")
+                    throw new Error("restart approval no longer has owner fallback");
+            }
             const scenarioHandleDigest = acceptanceMarker()?.scenarioHandleDigest;
             const committed = (0, tool_approval_1.commitApprovalProposal)({
                 approvalStore: store,
@@ -279,6 +359,7 @@ function createTelegramApprovalRuntime(options) {
                     transportChatId: options.subject,
                     expiresAt: new Date(now() + 300_000).toISOString(),
                     frozenAssistantMessage: request.frozenAssistantMessage,
+                    ...(ownerBinding ? { ownerBinding } : {}),
                     ...(scenarioHandleDigest ? { scenarioHandleDigest } : {}),
                 },
                 preCallMessages: request.preCallMessages,
@@ -369,7 +450,7 @@ function createTelegramApprovalRuntime(options) {
                 completeContinuation: () => { effectBarrier(); store.completeContinuation({ approvalId: record.approvalId, ownerId: continuationOwnerId, epoch: continuationEpoch }); },
                 runAgent: provider,
                 revalidate: async () => {
-                    const current = await currentOptions(record);
+                    const current = await currentOptions(record, "continuation");
                     continuationAuthorized = current !== null;
                     return current ? { ...current, ...approvalContinuationRunAgentOptions(current.toolContext, continuationCoordinator) } : null;
                 },
@@ -457,6 +538,7 @@ function createTelegramApprovalRuntime(options) {
             }
             else if (existing.state === "proposed") {
                 const ownerId = `telegram-decision-${(0, node_crypto_1.randomUUID)()}`;
+                let restartApproval;
                 let definition;
                 record = await (0, session_transaction_1.withSessionTurnLease)(existing.sessionPath, async (lease) => (0, tool_approval_1.executeApprovalDecision)({
                     approvalStore: store,
@@ -470,31 +552,67 @@ function createTelegramApprovalRuntime(options) {
                         sessionKey: existing.sessionKey,
                     },
                     ownerId,
-                    currentSessionRevision: (0, session_transaction_1.readSessionTransaction)(existing.sessionPath, lease).revision,
+                    currentSessionRevision: () => (0, session_transaction_1.readSessionTransaction)(existing.sessionPath, lease).revision,
                     resolveTool: async (name) => {
-                        const current = await currentOptions(existing);
+                        const current = await currentOptions(existing, "decision");
                         definition = current ? resolveTool(name, current.toolContext.toolSelection) : undefined;
                         return definition;
                     },
                     resolveApprovalPolicy: async (name, args) => {
-                        const current = await currentOptions(existing);
+                        const current = await currentOptions(existing, "decision");
                         return current ? (0, tools_1.approvalPolicyForInvocation)(name, args, current.toolContext) : { kind: "not_required" };
                     },
-                    liveGuard: async () => ({ ok: true }),
+                    liveGuard: async (context) => {
+                        if (existing.toolName !== "unraid_restart_container")
+                            return { ok: true };
+                        const current = await currentOptions(existing, "decision");
+                        if (!current || !existing.ownerBinding)
+                            return { ok: false, reason: "restart approval owner binding is unavailable" };
+                        const restartToolContext = current.toolContext;
+                        const authorization = await (0, relationship_authorization_1.authorizeRestartApprovalRequester)(restartToolContext, context.arguments, existing.ownerBinding);
+                        if (!authorization.allowed)
+                            return { ok: false, reason: authorization.reason };
+                        try {
+                            const listed = await restartToolContext.sanctuary?.listContainers();
+                            if (!listed || typeof listed !== "object" || !("ok" in listed) || listed.ok !== true
+                                || !("data" in listed) || !listed.data || typeof listed.data !== "object"
+                                || !("truncated" in listed.data) || listed.data.truncated !== false
+                                || !("containers" in listed.data) || !Array.isArray(listed.data.containers)) {
+                                return { ok: false, reason: "restart approval inventory is invalid" };
+                            }
+                            const matches = listed.data.containers.filter((target) => target?.name === context.arguments.container);
+                            const target = matches[0];
+                            if (matches.length !== 1 || typeof target?.id !== "string" || !target.id.trim() || target.id !== target.id.trim() || target.degraded !== false) {
+                                return { ok: false, reason: "restart approval target is not exact" };
+                            }
+                            restartApproval = Object.freeze({
+                                approvalId: existing.approvalId, agentRoot, sessionPath: existing.sessionPath,
+                                ownerBinding: Object.freeze({ ...existing.ownerBinding }),
+                                argumentDigest: existing.argumentDigest,
+                                target: Object.freeze({ id: target.id, name: String(context.arguments.container) }),
+                            });
+                            return { ok: true };
+                        }
+                        catch {
+                            return { ok: false, reason: "restart approval target is unavailable" };
+                        }
+                    },
                     liveRisk: async () => ({ ok: true }),
                     preflight: async (context) => {
-                        const current = await currentOptions(existing);
+                        const current = await currentOptions(existing, "decision");
                         if (!current)
                             return { ok: false, reason: "current tool authority is unavailable" };
-                        const result = await (0, tools_1.preflightToolCall)(context.record.toolName, context.arguments, invocationContext(current, context.definition));
+                        const result = await (0, tools_1.preflightToolCall)(context.record.toolName, context.arguments, invocationContext(current, context.definition, restartApproval));
                         return result.kind === "ready" ? { ok: true } : { ok: false, reason: result.text };
                     },
                     hooks: telegramApprovalDecisionBarrierHooks(effectBarrier),
                     execute: async (name, args) => {
-                        const current = await currentOptions(existing);
+                        if (name === "unraid_restart_container" && !restartApproval)
+                            return { kind: "rejected_before_handler", text: "restart approval was not revalidated" };
+                        const current = await currentOptions(existing, "decision");
                         if (!current || !definition)
                             return { kind: "rejected_before_handler", text: "current approved tool authority is unavailable" };
-                        const approvedToolContext = invocationContext(current, definition);
+                        const approvedToolContext = invocationContext(current, definition, restartApproval);
                         const execute = () => executeApprovedTelegramTool(name, args, (toolName, toolArgs) => (0, tools_1.executeTool)(toolName, toolArgs, approvedToolContext, options.dependencies?.executeTool), decisionScenarioDigest, existing.approvalId, effectBarrier);
                         return decisionScenarioDigest
                             ? (0, sanctuary_acceptance_marker_1.runWithSanctuaryAcceptanceApproval)({ approvalId: existing.approvalId, argumentDigest: existing.argumentDigest }, execute)

package/dist/senses/telegram.js

@@ -913,6 +913,12 @@ function createTelegramSenseApp(options) {
             subject,
             identityKey,
             toolContext: toolContext ?? {},
+            ...(options.resolveRelationshipAuthorization ? {
+                resolveOwnerRelationship: (binding) => options.resolveRelationshipAuthorization({
+                    friendId: binding.friendId, requestId: binding.requestId, sessionEventId: binding.sessionEventId, sessionKey: binding.sessionKey,
+                    botId: botId, userId: authorizedUserId, chatId: authorizedChatId,
+                }),
+            } : {}),
             resolveLiveToolContext: async (record) => {
                 const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
                 if (record.transport !== "telegram" || record.requesterId !== subject
@@ -1669,6 +1675,26 @@ function createTelegramSenseApp(options) {
     catch (error) {
         releaseAcceptanceAudit(error);
     }
+    const pendingCleanup = new Set([
+        () => poll.stop(),
+        async () => { await runPromise?.catch(() => undefined); },
+        async () => { await Promise.all([...approvalReconciliationsInFlight]); },
+        async () => { await interactiveControl?.stop(); },
+        () => api.stop(),
+        () => approvalRuntime?.close(),
+        () => effectJournal?.close(),
+        () => admissionStore?.close(),
+        () => (0, tools_awaiting_1.resetAwaitToolDeps)(),
+        () => runWithAcceptanceAuditOwner(() => {
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.telegram_poll_end",
+                message: "Telegram long poll stopped",
+                meta: { agentName: options.agentName, subject },
+            });
+        }),
+        retireAcceptanceAudit,
+    ]);
     return {
         run(signal) {
             if (runPromise)
@@ -1762,37 +1788,20 @@ function createTelegramSenseApp(options) {
                 return stopPromise;
             stopPromise = (async () => {
                 const errors = [];
-                const attempt = async (operation) => {
+                for (const operation of pendingCleanup) {
                     try {
                         await operation();
+                        pendingCleanup.delete(operation);
                     }
                     catch (error) {
                         errors.push(error);
                     }
-                };
-                await attempt(() => poll.stop());
-                await attempt(async () => { await runPromise?.catch(() => undefined); });
-                await attempt(async () => { await Promise.all([...approvalReconciliationsInFlight]); });
-                await attempt(async () => { await interactiveControl?.stop(); });
-                await attempt(() => api.stop());
-                await attempt(() => approvalRuntime?.close());
-                await attempt(() => effectJournal?.close());
-                await attempt(() => admissionStore?.close());
-                await attempt(() => (0, tools_awaiting_1.resetAwaitToolDeps)());
-                await attempt(() => runWithAcceptanceAuditOwner(() => {
-                    (0, runtime_1.emitNervesEvent)({
-                        component: "senses",
-                        event: "senses.telegram_poll_end",
-                        message: "Telegram long poll stopped",
-                        meta: { agentName: options.agentName, subject },
-                    });
-                }));
-                await attempt(retireAcceptanceAudit);
+                }
                 if (errors.length === 1)
                     throw errors[0];
                 if (errors.length > 1)
                     throw new AggregateError(errors, "Telegram sense cleanup failed");
-            })();
+            })().catch((error) => { stopPromise = undefined; throw error; });
             return stopPromise;
         },
     };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.814",
+  "version": "0.1.0-alpha.816",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.814",
+      "version": "0.1.0-alpha.816",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.814",
+  "version": "0.1.0-alpha.816",
   "engines": {
     "node": ">=22"
   },