@ouro.bot/cli 0.1.0-alpha.815 → 0.1.0-alpha.817

package/dist/repertoire/relationship-authorization.js

@@ -33,6 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.routineActionRequester = routineActionRequester;
+exports.authorizeRestartApprovalRequester = authorizeRestartApprovalRequester;
+exports.authorizeRoutineActionRequester = authorizeRoutineActionRequester;
 exports.renderRelationshipPreferences = renderRelationshipPreferences;
 exports.withRelationshipPreference = withRelationshipPreference;
 exports.loadRelationshipCapabilityRegistry = loadRelationshipCapabilityRegistry;
@@ -43,7 +46,132 @@ exports.authorizeRelationshipAccess = authorizeRelationshipAccess;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const router_1 = require("../heart/external-events/router");
 const runtime_1 = require("../nerves/runtime");
+function routineActionRequester(ctx, eventTarget) {
+    const relationship = ctx?.relationshipAuthorization;
+    if (!relationship)
+        return null;
+    if (ctx?.currentExternalEvent) {
+        if (!eventTarget || relationship.profileId !== "sanctuary-event")
+            return null;
+        const events = [ctx.currentExternalEvent, ...(ctx.currentExternalEvent.relatedEvents ?? [])].filter((event) => event.schemaVersion === 1 && event.source === "sanctuary-health" && event.eventId === `container:${eventTarget.target.id}:availability`);
+        if (events.length !== 1)
+            return null;
+        const event = events[0];
+        return {
+            kind: "owner_event", friendId: eventTarget.friendId, profileId: relationship.profileId,
+            event: { schemaVersion: 1, recordPath: event.recordPath, agent: event.agent, source: event.source, eventId: event.eventId, generation: event.generation, observationRevision: event.observationRevision, claimOwner: event.claimOwner },
+            target: { ...eventTarget.target },
+        };
+    }
+    const actor = relationship.actor;
+    const session = ctx?.currentSession;
+    if (!actor || !session || session.channel !== "telegram" || session.friendId !== actor.friendId
+        || [actor.friendId, actor.sessionEventId, relationship.requestId, session.key].some((value) => typeof value !== "string" || !value.trim()))
+        return null;
+    const kind = actor.trustLevel === "family" && relationship.profileId === "sanctuary-owner" ? "owner"
+        : actor.trustLevel === "friend" && relationship.profileId === "sanctuary-household" ? "household_request" : null;
+    if (!kind)
+        return null;
+    return { kind, friendId: actor.friendId, profileId: relationship.profileId, requestId: relationship.requestId, sessionEventId: actor.sessionEventId, origin: { friendId: session.friendId, channel: session.channel, key: session.key } };
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function authorizeRestartApprovalRequester(ctx, args, binding) {
+    return authorizeRoutineActionRequester(ctx, args, {
+        requester: {
+            kind: "owner", friendId: binding.friendId, profileId: "sanctuary-owner", requestId: binding.requestId,
+            sessionEventId: binding.sessionEventId, origin: { friendId: binding.friendId, channel: "telegram", key: binding.sessionKey },
+        },
+        profileVersion: binding.profileVersion,
+    });
+}
+async function authorizeRoutineActionRequester(ctx, args, expected) {
+    if (!isRecord(args) || Object.keys(args).length !== 1 || typeof args.container !== "string"
+        || !args.container || args.container !== args.container.trim() || Buffer.byteLength(args.container) > 128 || args.container.includes("\uFFFD")
+        || !ctx?.agentRoot || !ctx.relationshipAuthorization)
+        return { allowed: false, reason: "routine action requires one exact target and current relationship" };
+    const target = args.container;
+    const agentRoot = ctx.agentRoot;
+    const relationship = ctx.relationshipAuthorization;
+    const sanctuary = ctx.sanctuary;
+    const initialRequester = routineActionRequester(ctx);
+    const event = ctx.currentExternalEvent && structuredClone(ctx.currentExternalEvent);
+    if (!initialRequester && (!event || event.source !== "sanctuary-health" || relationship.profileId !== "sanctuary-event"))
+        return { allowed: false, reason: "routine action requires a current human request or health event" };
+    const unchanged = () => ctx.agentRoot === agentRoot && ctx.relationshipAuthorization === relationship && ctx.sanctuary === sanctuary
+        && args.container === target && Object.keys(args).length === 1
+        && (0, node_util_1.isDeepStrictEqual)(initialRequester, routineActionRequester(ctx)) && (0, node_util_1.isDeepStrictEqual)(event, ctx.currentExternalEvent);
+    let authorization;
+    try {
+        authorization = await relationship.authorizeTool("unraid_restart_container", { container: target });
+    }
+    catch {
+        return { allowed: false, reason: "routine relationship authorization is unavailable" };
+    }
+    if (!authorization?.allowed)
+        return { allowed: false, reason: authorization?.allowed === false ? authorization.reason : "routine relationship authorization is unavailable" };
+    if (typeof authorization.profileVersion !== "number" || !Number.isSafeInteger(authorization.profileVersion) || authorization.profileVersion < 1
+        || typeof authorization.receiptId !== "string" || !authorization.receiptId.trim())
+        return { allowed: false, reason: "routine relationship authorization is not versioned" };
+    if (expected && authorization.profileVersion !== expected.profileVersion)
+        return { allowed: false, reason: "routine relationship profile version changed" };
+    if (!unchanged() || (authorization.profileId !== undefined && authorization.profileId !== relationship.profileId))
+        return { allowed: false, reason: "routine request binding changed during authorization" };
+    if (!event) {
+        if (!initialRequester || initialRequester.kind === "owner_event"
+            || (authorization.friendId !== undefined && authorization.friendId !== initialRequester.friendId)
+            || (authorization.requestId !== undefined && authorization.requestId !== initialRequester.requestId)
+            || (expected && !(0, node_util_1.isDeepStrictEqual)(expected.requester, initialRequester)))
+            return { allowed: false, reason: "routine request binding does not match live authorization" };
+        return { allowed: true, requester: initialRequester, receiptId: authorization.receiptId, profileVersion: authorization.profileVersion };
+    }
+    if (!sanctuary || authorization.profileId !== "sanctuary-event" || typeof authorization.friendId !== "string" || !authorization.friendId.trim())
+        return { allowed: false, reason: "current health event authorization is unavailable" };
+    let eventTarget;
+    if (expected) {
+        if (expected.requester.kind !== "owner_event" || expected.requester.target.name !== target)
+            return { allowed: false, reason: "current health event target binding changed" };
+        eventTarget = expected.requester.target;
+    }
+    else {
+        let listed;
+        try {
+            listed = await sanctuary.listContainers();
+        }
+        catch {
+            return { allowed: false, reason: "current health event container status is unavailable" };
+        }
+        if (!isRecord(listed) || listed.ok !== true || !isRecord(listed.data) || listed.data.truncated !== false || !Array.isArray(listed.data.containers))
+            return { allowed: false, reason: "current health event container status is invalid" };
+        const matches = listed.data.containers.filter((value) => isRecord(value) && value.name === target);
+        const container = matches[0];
+        if (matches.length !== 1 || !container || typeof container.id !== "string" || !container.id.trim()
+            || container.state !== "exited" || container.degraded !== false)
+            return { allowed: false, reason: "current health event target is not exactly stopped" };
+        eventTarget = { id: container.id, name: target };
+    }
+    const requester = routineActionRequester(ctx, { friendId: authorization.friendId, target: eventTarget });
+    if (!requester || requester.kind !== "owner_event" || !unchanged() || (expected && !(0, node_util_1.isDeepStrictEqual)(expected.requester, requester)))
+        return { allowed: false, reason: "current health event target or request binding changed" };
+    let current;
+    try {
+        current = (0, router_1.readExternalEventRecord)(requester.event.recordPath);
+    }
+    catch {
+        return { allowed: false, reason: "current health event record is unavailable" };
+    }
+    const lease = requester.event;
+    if (current.agent !== lease.agent || current.source !== lease.source || current.eventId !== lease.eventId || current.eventType !== "health.observed"
+        || current.generation !== lease.generation || current.observationRevision !== lease.observationRevision || current.claimOwner !== lease.claimOwner
+        || current.executionState !== "running" || !(Date.parse(current.claimExpiresAt ?? "") > Date.now())
+        || current.transition === "recovered" || current.pendingObservation !== null)
+        return { allowed: false, reason: "current health event claim or observation changed" };
+    return { allowed: true, requester, receiptId: authorization.receiptId, profileVersion: authorization.profileVersion };
+}
 function renderRelationshipPreferences(friend) {
     const now = Date.now();
     return Object.entries(friend.relationshipPolicy?.preferences ?? {})

package/dist/repertoire/tools-base.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.tools = exports.baseToolDefinitions = exports.editFileReadTracker = exports.renderInnerProgressStatus = exports.speakTool = exports.restTool = exports.settleTool = exports.observeTool = exports.ponderTool = void 0;
-exports.routineActionRequester = routineActionRequester;
+exports.tools = exports.baseToolDefinitions = exports.editFileReadTracker = exports.routineActionRequester = exports.renderInnerProgressStatus = exports.speakTool = exports.restTool = exports.settleTool = exports.observeTool = exports.ponderTool = void 0;
+exports.routineActionDenied = routineActionDenied;
+const runtime_1 = require("../nerves/runtime");
 const tools_files_1 = require("./tools-files");
 const tools_shell_1 = require("./tools-shell");
 const tools_notes_1 = require("./tools-notes");
@@ -40,17 +41,12 @@ Object.defineProperty(exports, "speakTool", { enumerable: true, get: function ()
 // Re-export renderInnerProgressStatus for consumers
 var tools_session_2 = require("./tools-session");
 Object.defineProperty(exports, "renderInnerProgressStatus", { enumerable: true, get: function () { return tools_session_2.renderInnerProgressStatus; } });
-function routineActionRequester(ctx) {
-    const actor = ctx?.relationshipAuthorization?.actor;
-    if (!actor)
-        return null;
-    if (actor.trustLevel === "family")
-        return { kind: "owner", friendId: actor.friendId };
-    const requestId = ctx?.relationshipAuthorization?.requestId;
-    const session = ctx?.currentSession;
-    if (actor.trustLevel !== "friend" || !requestId || !session || session.friendId !== actor.friendId)
-        return null;
-    return { kind: "household_request", friendId: actor.friendId, requestId, origin: { friendId: session.friendId, channel: session.channel, key: session.key } };
+var relationship_authorization_1 = require("./relationship-authorization");
+Object.defineProperty(exports, "routineActionRequester", { enumerable: true, get: function () { return relationship_authorization_1.routineActionRequester; } });
+function routineActionDenied(reason) {
+    const message = reason.slice(0, 500);
+    (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.routine_action_denied", message: "routine action denied", meta: { reason: message } });
+    return JSON.stringify({ ok: false, error: { code: "routine_action_denied", message, degraded: true } });
 }
 // Tracks which file paths have been read via read_file in this session.
 // edit_file requires a file to be read first (must-read-first guard).

package/dist/repertoire/tools-sanctuary-host.js

@@ -0,0 +1,202 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rootHostToolDefinition = exports.RootHostAuthorizationError = void 0;
+exports.authorizeRootHostContext = authorizeRootHostContext;
+exports.validateRootHostToolArguments = validateRootHostToolArguments;
+exports.selectRootHostTool = selectRootHostTool;
+exports.authorizeRootHostToolInvocation = authorizeRootHostToolInvocation;
+const path = __importStar(require("node:path"));
+const node_util_1 = require("node:util");
+const runtime_1 = require("../nerves/runtime");
+const sanctuary_host_authority_1 = require("../heart/daemon/sanctuary-host-authority");
+const session_events_1 = require("../heart/session-events");
+const shared_turn_1 = require("../senses/shared-turn");
+const relationship_authorization_1 = require("./relationship-authorization");
+const tool_arguments_1 = require("./tool-arguments");
+const NAME = "sanctuary_host_execute";
+const bindings = new WeakMap();
+const selections = new WeakMap();
+class RootHostAuthorizationError extends Error {
+}
+exports.RootHostAuthorizationError = RootHostAuthorizationError;
+function requireOwner(condition) {
+    if (!condition)
+        throw new RootHostAuthorizationError("Sanctuary root host authorization denied");
+}
+function ownerFriend(friend, port) {
+    requireOwner(friend?.admissionState === "active" && friend.trustLevel === "family"
+        && friend.initiativePolicy === "proactive" && friend.capabilityProfileId === "sanctuary-owner");
+    const identities = friend.externalIds.filter((identity) => identity.provider === "telegram-user" && identity.tenantId === port.pins.expectedBotId);
+    requireOwner(identities.length === 1 && identities[0].externalId === port.pins.expectedOwnerUserId);
+}
+function currentCoordinates(ctx) {
+    const root = ctx.rootHost;
+    const relationship = ctx.relationshipAuthorization;
+    const actor = relationship?.actor;
+    const session = ctx.currentSession;
+    const friend = ctx.context?.friend;
+    requireOwner(ctx.agentName === "sanctuary" && typeof ctx.agentRoot === "string" && path.isAbsolute(ctx.agentRoot)
+        && path.resolve(ctx.agentRoot) === ctx.agentRoot && path.basename(ctx.agentRoot) === "sanctuary.ouro");
+    requireOwner(root && root.port.isHealthy() && !ctx.currentExternalEvent);
+    requireOwner(relationship?.profileId === "sanctuary-owner" && relationship.advertisedToolNames?.includes(NAME));
+    ownerFriend(friend, root.port);
+    requireOwner(actor && actor.trustLevel === "family" && actor.friendId === friend.id && session?.friendId === friend.id
+        && session.channel === "telegram" && ctx.context.channel.channel === "telegram");
+    requireOwner([friend.id, actor.sessionEventId, relationship.requestId, session.key].every((value) => typeof value === "string" && value.trim().length > 0));
+    const sessionPath = (0, shared_turn_1.getSenseSessionPath)("sanctuary", friend.id, "telegram", session.key, ctx.agentRoot);
+    requireOwner(session.sessionPath === sessionPath && sessionPath.startsWith(`${ctx.agentRoot}${path.sep}`));
+    const envelope = (0, session_events_1.loadSessionEnvelopeFile)(sessionPath);
+    const latest = envelope && (0, session_events_1.selectEffectiveSessionEvents)(envelope.events).findLast((event) => event.role === "user");
+    requireOwner(latest && latest.id === actor.sessionEventId && latest.relations.references.includes(relationship.requestId));
+    const profile = (0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(ctx.agentRoot).profiles["sanctuary-owner"];
+    requireOwner(profile && Number.isSafeInteger(profile.version) && profile.version >= 9 && profile.toolNames.includes(NAME));
+    return {
+        agentRoot: ctx.agentRoot, friendId: friend.id, requestId: relationship.requestId, sessionKey: session.key,
+        sessionPath, sessionEventId: actor.sessionEventId, profileId: "sanctuary-owner", profileVersion: profile.version,
+        keyId: root.port.pins.expectedKeyId, publicKeyDigest: root.port.pins.expectedPublicKeyDigest, targetHost: root.port.pins.expectedTargetHost,
+    };
+}
+function observationAccepted(ctx) {
+    const root = ctx.rootHost;
+    return !!root.observation && root.port.acceptsObservation(root.observation)
+        && root.observation.keyId === root.port.pins.expectedKeyId
+        && root.observation.publicKeyDigest === root.port.pins.expectedPublicKeyDigest
+        && root.observation.targetHost === root.port.pins.expectedTargetHost;
+}
+async function authorizeRootHostContext(ctx, expected) {
+    const previous = ctx.rootHost?.binding;
+    const provenance = previous && bindings.get(previous);
+    if (previous)
+        bindings.delete(previous);
+    const coordinates = currentCoordinates(ctx);
+    const root = ctx.rootHost;
+    const port = root.port;
+    const relationship = ctx.relationshipAuthorization;
+    const store = ctx.friendStore;
+    requireOwner(store && (expected ? (0, node_util_1.isDeepStrictEqual)(coordinates, expected) : observationAccepted(ctx)));
+    const friend = await store.get(coordinates.friendId);
+    ownerFriend(friend, port);
+    requireOwner(friend.id === coordinates.friendId);
+    const decision = await relationship.authorizeTool(NAME, {});
+    requireOwner(decision.allowed && decision.profileId === coordinates.profileId && decision.profileVersion === coordinates.profileVersion
+        && decision.friendId === coordinates.friendId && decision.requestId === coordinates.requestId
+        && typeof decision.receiptId === "string" && decision.receiptId.trim().length > 0);
+    requireOwner(ctx.rootHost === root && root.port === port && root.binding === previous && ctx.relationshipAuthorization === relationship && ctx.friendStore === store
+        && (0, node_util_1.isDeepStrictEqual)(coordinates, currentCoordinates(ctx)) && (expected !== undefined || observationAccepted(ctx)));
+    const binding = previous && provenance?.port === root.port && provenance.recovery === (expected !== undefined) && (0, node_util_1.isDeepStrictEqual)(previous, coordinates)
+        ? previous : Object.freeze(coordinates);
+    bindings.set(binding, { port: root.port, recovery: expected !== undefined });
+    root.binding = binding;
+    return binding;
+}
+const printable = (maximum) => ({ type: "string", minLength: 1, maxLength: maximum, pattern: "^[\\x20-\\x7e]+$" });
+const argumentsSchema = { type: "array", maxItems: 64, items: printable(512) };
+exports.rootHostToolDefinition = (0, tool_arguments_1.freezeToolValue)({
+    tool: {
+        type: "function",
+        function: {
+            name: NAME,
+            description: "Propose one exact Sanctuary host command for root-owned owner approval. Nothing executes until root approval and signed permit verification. verification is optional and defaults to null.",
+            parameters: {
+                type: "object", additionalProperties: false,
+                required: ["targetHost", "targetResource", "command", "workingDirectoryProfile", "environmentProfile", "timeoutMs"],
+                properties: {
+                    targetHost: printable(256), targetResource: printable(256),
+                    command: {
+                        oneOf: [
+                            { type: "object", additionalProperties: false, required: ["kind", "executable", "arguments"], properties: {
+                                    kind: { const: "executable" }, executable: printable(512), arguments: argumentsSchema,
+                                } },
+                            { type: "object", additionalProperties: false, required: ["kind", "interpreter", "arguments", "script"], properties: {
+                                    kind: { const: "script" }, interpreter: printable(512), arguments: argumentsSchema,
+                                    script: { type: "string", minLength: 1, maxLength: 2048, pattern: "^[\\x0a\\x20-\\x7e]+$" },
+                                } },
+                        ],
+                    },
+                    workingDirectoryProfile: { const: "host.root.v1" }, environmentProfile: { const: "host.clean.v1" },
+                    timeoutMs: { type: "integer", minimum: 1000, maximum: 900000 },
+                    verification: {
+                        type: "object", nullable: true, additionalProperties: false, required: ["profile", "expectedStateDigest"],
+                        properties: { profile: { const: "file.digest.v1" }, expectedStateDigest: { type: "string", pattern: "^sha256:[a-f0-9]{64}$" } },
+                    },
+                },
+            },
+        },
+    },
+    requiredCapability: "approval-continuation",
+    summaryKeys: ["targetHost", "targetResource"],
+    riskProfile: { risk: "high", mutates: "external_side_effect", reason: "owner-approved arbitrary host command" },
+    approvalPolicy: () => ({ kind: "required", policyId: "sanctuary.host.owner-approved.v1", actionClass: "owner_approved_arbitrary_host", requiresSoleCall: true }),
+    handler: () => { throw new Error("Sanctuary host execution requires the root approval continuation; resident execution is forbidden"); },
+});
+function validateRootHostToolArguments(args, targetHost) {
+    requireOwner(!Object.hasOwn(args, "ownerObservation"));
+    const proposal = {
+        ...args, verification: args.verification === undefined ? null : args.verification,
+        ownerObservation: { digest: `sha256:${"0".repeat(64)}`, updateId: 0, userId: "1", chatId: "1", messageId: "1" },
+    };
+    // S4 owns command canonicalization. This placeholder only validates the model-owned fields.
+    (0, sanctuary_host_authority_1.validateHostProposalRequest)(proposal, targetHost);
+    const { ownerObservation: _observation, ...command } = proposal;
+    return structuredClone(command);
+}
+function selectRootHostTool(ctx, capabilities) {
+    try {
+        const binding = ctx?.rootHost?.binding;
+        const provenance = binding && bindings.get(binding);
+        if (!ctx || !binding || !provenance || provenance.port !== ctx.rootHost.port || !capabilities?.has("approval-continuation")
+            || !(0, node_util_1.isDeepStrictEqual)(binding, currentCoordinates(ctx)) || (!provenance.recovery && !observationAccepted(ctx)))
+            return undefined;
+        const selected = Object.freeze({ ...exports.rootHostToolDefinition });
+        selections.set(selected, { binding, capabilities });
+        return selected;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function authorizeRootHostToolInvocation(ctx, definition, args) {
+    const selected = definition && selections.get(definition);
+    requireOwner(ctx && selected && ctx.rootHost?.binding === selected.binding && ctx.toolSelection?.ordinary.includes(definition));
+    if (!ctx.rootHost.port.isHealthy() && !await ctx.rootHost.port.refresh())
+        throw new Error("Sanctuary root host authority is unavailable");
+    requireOwner(selectRootHostTool(ctx, selected.capabilities));
+    const provenance = bindings.get(selected.binding);
+    await authorizeRootHostContext(ctx, provenance.recovery ? selected.binding : undefined);
+    requireOwner(selectRootHostTool(ctx, selected.capabilities));
+    validateRootHostToolArguments(args, selected.binding.targetHost);
+    (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.sanctuary_host_invocation_admitted", message: "Owner host-tool invocation admitted to the root approval path" });
+}

package/dist/repertoire/tools-steward-policy.js

@@ -16,7 +16,7 @@ exports.stewardPolicyToolDefinition = {
         type: "function",
         function: {
             name: "steward_policy_manage",
-            description: "Read or update the household steward's typed desired-state and routine-action policy. Updates require the current authenticated family request. expectedVersion is optional; omit it to apply against the current policy version, or supply a version from read for explicit stale-write detection.",
+            description: "Read or update the household steward's typed desired-state and routine-action policy. Updates require the current authenticated owner Telegram request and fresh authorization. expectedVersion is optional; omit it to apply against the current policy version, or supply a version from read for explicit stale-write detection.",
             parameters: {
                 type: "object",
                 properties: {
@@ -48,13 +48,20 @@ exports.stewardPolicyToolDefinition = {
             (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.steward_policy_tool_call", message: "read steward policy", meta: { action: "read" } });
             return JSON.stringify((0, steward_policy_1.readStewardPolicy)(ctx.agentRoot));
         }
-        const actor = ctx.relationshipAuthorization?.actor;
+        const relationship = ctx.relationshipAuthorization;
+        const actor = relationship.actor;
         if (!actor)
             throw new Error("steward policy mutation requires authenticated relationship authority");
-        const expectedVersion = args.expectedVersion === undefined
-            ? (0, steward_policy_1.readStewardPolicy)(ctx.agentRoot).version
-            : Number(args.expectedVersion);
-        if (!Number.isInteger(expectedVersion) || expectedVersion < 0)
+        const { friendId, trustLevel, sessionEventId } = actor;
+        const { profileId, requestId } = relationship;
+        const sessionKey = ctx.currentSession?.key;
+        if (trustLevel !== "family" || profileId !== "sanctuary-owner" || typeof requestId !== "string" || !requestId.trim()
+            || typeof sessionKey !== "string" || !sessionKey.trim() || !sessionEventId.trim()
+            || ctx.currentSession?.friendId !== friendId || ctx.currentSession.channel !== "telegram" || ctx.currentExternalEvent) {
+            throw new Error("steward policy mutation requires a current authenticated owner Telegram request and session");
+        }
+        const expectedVersion = args.expectedVersion === undefined ? undefined : Number(args.expectedVersion);
+        if (expectedVersion !== undefined && (!Number.isSafeInteger(expectedVersion) || expectedVersion < 0))
             throw new Error("expectedVersion must be a nonnegative integer");
         let mutation;
         if (args.action === "set_desired_state") {
@@ -85,11 +92,28 @@ exports.stewardPolicyToolDefinition = {
         }
         else
             throw new Error("steward policy action is invalid");
-        const result = (0, steward_policy_1.updateStewardPolicy)(ctx.agentRoot, { expectedVersion, actor, mutation });
-        (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.steward_policy_tool_call", message: "updated steward policy", meta: { action: args.action } });
-        return JSON.stringify(result);
+        const agentRoot = ctx.agentRoot;
+        return Promise.resolve(relationship.authorizeTool("steward_policy_manage", args)).then((authorization) => {
+            if (!authorization.allowed)
+                throw new Error(`steward policy authorization denied: ${authorization.reason}`);
+            if (typeof authorization.profileVersion !== "number" || !Number.isSafeInteger(authorization.profileVersion) || authorization.profileVersion < 1 || !authorization.receiptId.trim()) {
+                throw new Error("steward policy owner authorization is not versioned");
+            }
+            if (ctx.relationshipAuthorization !== relationship || relationship.profileId !== profileId || relationship.requestId !== requestId
+                || relationship.actor?.friendId !== friendId || relationship.actor.trustLevel !== trustLevel || relationship.actor.sessionEventId !== sessionEventId
+                || ctx.currentSession?.friendId !== friendId || ctx.currentSession.key !== sessionKey || ctx.currentSession.channel !== "telegram" || ctx.currentExternalEvent) {
+                throw new Error("steward policy owner authorization or session changed before mutation");
+            }
+            const result = (0, steward_policy_1.updateStewardPolicy)(agentRoot, {
+                expectedVersion: expectedVersion ?? (0, steward_policy_1.readStewardPolicy)(agentRoot).version,
+                actor: { friendId, trustLevel, sessionEventId, authorization: { profileId, requestId, sessionKey, receiptId: authorization.receiptId, profileVersion: authorization.profileVersion } },
+                mutation,
+            });
+            (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.steward_policy_tool_call", message: "updated steward policy", meta: { action: args.action } });
+            return JSON.stringify(result);
+        });
     },
     riskProfile: (args) => args.action === "read"
         ? { mutates: "none", risk: "low" }
-        : { mutates: "durable_state_write", risk: "high", reason: "updates typed household steward policy under authenticated family authority" },
+        : { mutates: "durable_state_write", risk: "high", reason: "updates typed household steward policy under current authenticated owner authority" },
 };

package/dist/repertoire/tools-unraid.js

@@ -7,6 +7,8 @@ const node_crypto_1 = require("node:crypto");
 const runtime_1 = require("../nerves/runtime");
 const unraid_client_1 = require("./unraid-client");
 const tools_base_1 = require("./tools-base");
+const relationship_authorization_1 = require("./relationship-authorization");
+const approval_store_1 = require("../heart/approval-store");
 const steward_policy_1 = require("../heart/steward-policy");
 const obligations_1 = require("../arc/obligations");
 exports.SANCTUARY_CONTAINERS_QUERY = `query SanctuaryContainers {
@@ -140,9 +142,11 @@ function liveSourceIdentityDigest(value) {
     return (0, node_crypto_1.createHash)("sha256").update(prefixedId).digest("hex");
 }
 function createUnraidReadTools(client) {
-    const listContainers = async () => {
+    const listContainers = async (signal) => {
         try {
-            const data = await client.read(exports.SANCTUARY_CONTAINERS_QUERY, {});
+            const data = signal
+                ? await client.read(exports.SANCTUARY_CONTAINERS_QUERY, {}, signal)
+                : await client.read(exports.SANCTUARY_CONTAINERS_QUERY, {});
             return { ok: true, data: mapContainers(data) };
         }
         catch (error) {
@@ -309,16 +313,14 @@ const emptyParameters = { type: "object", properties: {}, additionalProperties:
 function missingRuntime() {
     return JSON.stringify({ ok: false, error: { code: "invalid_response", message: "Sanctuary runtime is unavailable", degraded: true } });
 }
-function householdRepairObligation(ctx, target) {
-    const requester = (0, tools_base_1.routineActionRequester)(ctx);
-    if (requester?.kind !== "household_request")
+function householdRepairObligation(selection, target) {
+    if (selection?.kind !== "standing" || selection.requester.kind !== "household_request")
         return null;
-    if (!ctx.agentRoot)
-        throw new Error("household repair request tracking is unavailable");
-    const existing = (0, obligations_1.findPendingObligationForRequest)(ctx.agentRoot, { requestId: requester.requestId, owedTo: requester.origin });
+    const { agentRoot, requester } = selection;
+    const existing = (0, obligations_1.findPendingObligationForRequest)(agentRoot, { requestId: requester.requestId, owedTo: requester.origin });
     if (existing)
         return existing;
-    return (0, obligations_1.createObligation)(ctx.agentRoot, {
+    return (0, obligations_1.createObligation)(agentRoot, {
         origin: requester.origin,
         owedTo: requester.origin,
         requestId: requester.requestId,
@@ -328,12 +330,12 @@ function householdRepairObligation(ctx, target) {
         nextAction: `Restart ${target} under the Butler's standing grant and verify recovery`,
     });
 }
-async function runTrackedRestart(ctx, target, routine) {
-    const obligation = householdRepairObligation(ctx, target);
+async function runTrackedRestart(ctx, target, execution) {
+    const obligation = householdRepairObligation(ctx.routineActionSelection, target);
     if (obligation && ctx.agentRoot)
         (0, obligations_1.advanceObligation)(ctx.agentRoot, obligation.id, { status: "updating_runtime", latestNote: `Starting the requested restart of ${target}` });
     try {
-        const result = await ctx.sanctuary.restartContainer({ container: target }, routine ? { routine } : undefined);
+        const result = await ctx.sanctuary.restartContainer({ container: target }, execution);
         if (obligation && ctx.agentRoot) {
             const succeeded = !!result && typeof result === "object" && !Array.isArray(result) && result.ok === true;
             if (succeeded)
@@ -439,33 +441,78 @@ exports.unraidToolDefinitions = [
             },
         },
         handler: async (args, ctx) => {
+            if (ctx?.routineActionSelection?.kind === "denied")
+                return (0, tools_base_1.routineActionDenied)(ctx.routineActionSelection.reason);
             if (!ctx?.sanctuary)
                 return missingRuntime();
+            if (!ctx.routineActionSelection && !ctx.restartApproval && (ctx.relationshipAuthorization || ctx.currentExternalEvent))
+                return (0, tools_base_1.routineActionDenied)("routine action requires its standing selection or owner approval");
             const target = String(args.container);
-            let routine;
+            let execution;
+            if (ctx.restartApproval) {
+                const approval = ctx.restartApproval;
+                const unchanged = () => ctx.restartApproval === approval && !ctx.routineActionSelection && !ctx.currentExternalEvent
+                    && ctx.agentRoot === approval.agentRoot && !!approval.ownerBinding && !!approval.target && approval.target.name === target
+                    && !!approval.sessionPath && ctx.currentSession?.sessionPath === approval.sessionPath;
+                const reauthorize = async () => {
+                    if (!unchanged())
+                        return { allowed: false, reason: "restart approval binding changed" };
+                    const authorization = await (0, relationship_authorization_1.authorizeRestartApprovalRequester)(ctx, args, approval.ownerBinding);
+                    if (!authorization.allowed)
+                        return authorization;
+                    if (!unchanged())
+                        return { allowed: false, reason: "restart approval binding changed" };
+                    if ((0, approval_store_1.canonicalApprovalArguments)(args).digest !== approval.argumentDigest)
+                        return { allowed: false, reason: "restart approval arguments changed" };
+                    return authorization;
+                };
+                const authorization = await reauthorize();
+                if (!authorization.allowed)
+                    return (0, tools_base_1.routineActionDenied)(authorization.reason);
+                execution = {
+                    approval: {
+                        target: approval.target,
+                        reauthorize: async () => {
+                            const current = await reauthorize();
+                            if (!current.allowed)
+                                return current;
+                            const decision = (0, steward_policy_1.inspectRoutineActionGrant)(approval.agentRoot, {
+                                key: `unraid.restart:${target}`, action: "unraid.container.restart", target,
+                                requester: current.requester, authorizationVersion: current.profileVersion,
+                            });
+                            if (decision.allowed || !decision.approvalFallback)
+                                return { allowed: false, reason: decision.allowed ? "restart approval no longer has owner fallback" : decision.reason };
+                            return { allowed: true };
+                        },
+                    },
+                };
+            }
             if (ctx.routineActionSelection) {
-                if (!ctx.agentRoot || !(0, tools_base_1.routineActionRequester)(ctx))
-                    return JSON.stringify({ ok: false, error: { code: "approval_required", message: "routine action authorization is unavailable", degraded: true } });
-                const { key, expectedPolicyVersion } = ctx.routineActionSelection;
+                if (!ctx.agentRoot)
+                    return (0, tools_base_1.routineActionDenied)("routine action authorization is unavailable");
+                if (ctx.agentRoot !== ctx.routineActionSelection.agentRoot)
+                    return (0, tools_base_1.routineActionDenied)("routine action agent root changed");
+                const { key, expectedPolicyVersion, expectedDesiredStateVersion, expectedGrantVersion, requester, authorizationVersion } = ctx.routineActionSelection;
                 if (ctx.routineActionSelection.target !== target)
-                    return JSON.stringify({ ok: false, error: { code: "approval_required", message: "routine action arguments changed", degraded: true } });
-                const decision = (0, steward_policy_1.inspectRoutineActionGrant)(ctx.agentRoot, { key, action: "unraid.container.restart", target, expectedPolicyVersion });
+                    return (0, tools_base_1.routineActionDenied)("routine action arguments changed");
+                const decision = (0, steward_policy_1.inspectRoutineActionGrant)(ctx.agentRoot, { key, action: "unraid.container.restart", target, expectedPolicyVersion, expectedDesiredStateVersion, expectedGrantVersion, requester, authorizationVersion });
                 if (!decision.allowed)
-                    return JSON.stringify({ ok: false, error: { code: "approval_required", message: decision.reason, degraded: true } });
-                routine = {
-                    key,
-                    expectedPolicyVersion: decision.policyVersion,
-                    reauthorize: async () => {
-                        const authorization = await ctx.relationshipAuthorization.authorizeTool("unraid_restart_container", { container: target });
-                        if (!authorization.allowed)
-                            return authorization;
-                        if (!Number.isInteger(authorization.profileVersion) || Number(authorization.profileVersion) < 1)
-                            return { allowed: false, reason: "relationship capability profile is not versioned" };
-                        return { allowed: true, receiptId: authorization.receiptId, profileVersion: Number(authorization.profileVersion) };
-                    },
-                };
+                    return (0, tools_base_1.routineActionDenied)(decision.reason);
+                execution = { routine: {
+                        key,
+                        expectedPolicyVersion: decision.policyVersion,
+                        expectedDesiredStateVersion: decision.desiredStateVersion,
+                        expectedGrantVersion: decision.grantVersion,
+                        requester: structuredClone(decision.requester),
+                        reauthorize: async () => {
+                            const authorization = await (0, relationship_authorization_1.authorizeRoutineActionRequester)(ctx, { container: target }, { requester, profileVersion: authorizationVersion });
+                            if (!authorization.allowed)
+                                return authorization;
+                            return { allowed: true, receiptId: authorization.receiptId, profileVersion: authorization.profileVersion };
+                        },
+                    } };
             }
-            return JSON.stringify(await runTrackedRestart(ctx, target, routine));
+            return JSON.stringify(await runTrackedRestart(ctx, target, execution));
         },
         riskProfile: { mutates: "external_side_effect", risk: "high", reason: "restarts one existing allowlisted Docker container" },
         approvalPolicy: () => ({