@ouro.bot/cli 0.1.0-alpha.816 → 0.1.0-alpha.817

package/dist/senses/telegram.js

@@ -69,6 +69,9 @@ const sanctuary_download_credit_presentation_1 = require("./sanctuary-download-c
 const shared_turn_1 = require("./shared-turn");
 const config_1 = require("../heart/config");
 const telegram_client_1 = require("./telegram-client");
+const sanctuary_authority_resident_1 = require("./sanctuary-authority-resident");
+const root_host_approval_runtime_1 = require("./root-host-approval-runtime");
+const tools_sanctuary_host_1 = require("../repertoire/tools-sanctuary-host");
 const sanctuary_runtime_2 = require("./sanctuary-runtime");
 const sanctuary_full_visibility_contract_1 = require("./sanctuary-full-visibility-contract");
 const sanctuary_install_state_contract_1 = require("./sanctuary-install-state-contract");
@@ -671,8 +674,10 @@ function migrateTelegramSessionIdentity(agentRoot, legacyUserId, legacyChatId, s
 }
 function redactTelegramPrivateValues(error, privateValues) {
     let message = error instanceof Error ? error.message : String(error);
-    for (const privateValue of privateValues)
-        message = message.split(privateValue).join("[redacted]");
+    for (const privateValue of privateValues) {
+        if (privateValue)
+            message = message.split(privateValue).join("[redacted]");
+    }
     return message;
 }
 function parseTelegramSenseCredentials(value) {
@@ -683,10 +688,25 @@ function parseTelegramSenseCredentials(value) {
     };
 }
 function createTelegramSenseApp(options) {
-    const botToken = requiredText(options.credentials.botToken, "bot token");
+    const authorityTransport = options.authorityTransport;
+    if (authorityTransport && options.agentName !== "sanctuary") {
+        throw new Error("Sanctuary Telegram authority transport cannot serve another agent");
+    }
+    if (authorityTransport && options.credentials.botToken !== undefined) {
+        throw new Error("Sanctuary Telegram authority transport forbids a resident bot token");
+    }
+    const botToken = options.credentials.botToken === undefined
+        ? null
+        : requiredText(options.credentials.botToken, "bot token");
+    if (!botToken && !authorityTransport) {
+        throw new Error("Telegram bot token is missing; Sanctuary requires an explicit gateway transport");
+    }
     const botId = options.credentials.botId !== undefined
         ? canonicalTelegramId(options.credentials.botId, "bot id")
-        : options.admission ? telegramBotIdFromToken(botToken) : null;
+        : options.admission && botToken ? telegramBotIdFromToken(botToken) : null;
+    if (authorityTransport && botId === null) {
+        throw new Error("Sanctuary Telegram authority transport requires a pinned bot id");
+    }
     const authorizedUserId = canonicalTelegramId(options.credentials.authorizedUserId, "authorized user id");
     const authorizedChatId = canonicalTelegramId(options.credentials.authorizedChatId, "authorized chat id");
     const agentRoot = options._agentRoot ?? (0, identity_1.getAgentRoot)(options.agentName);
@@ -694,8 +714,9 @@ function createTelegramSenseApp(options) {
         ? readOrCreateTelegramIdentityKey(agentRoot)
         : canonicalTelegramIdentityKey(options.identityKey);
     const subject = opaqueTelegramSubject(identityKey, botId ?? botToken, authorizedUserId, authorizedChatId);
-    const transportError = (error) => redactTelegramPrivateValues(error, [botToken, authorizedUserId, authorizedChatId]);
-    const api = options.api ?? (0, telegram_client_1.createTelegramBotApi)({ token: botToken });
+    const transportPrivateValues = [botToken ?? "", authorizedUserId, authorizedChatId];
+    const transportError = (error) => redactTelegramPrivateValues(error, transportPrivateValues);
+    const api = authorityTransport?.api ?? options.api ?? (0, telegram_client_1.createTelegramBotApi)({ token: botToken });
     const offsetStore = options.offsetStore ?? new telegram_client_1.FileTelegramOffsetStore(path.join(agentRoot, "state", "senses", "telegram", "offset.json"));
     const inboxStore = options.inboxStore ?? new telegram_client_1.FileTelegramUpdateInboxStore(path.join(agentRoot, "state", "senses", "telegram", "inbox.json"));
     const admissionStore = options.admission
@@ -752,11 +773,11 @@ function createTelegramSenseApp(options) {
         if (!/^[0-9a-f]{64}$/u.test(scenarioHandleDigest))
             throw new Error("Telegram acceptance audit scenario handle is invalid");
         if (!acceptanceAuditLease) {
-            acceptanceAuditLease = acquireTelegramAcceptanceAudit(options.acceptanceReceiptRoot ?? agentRoot, options.agentName, identityKey, [botToken, authorizedUserId, authorizedChatId], scenarioHandleDigest, options._acceptanceAuditReleaseHook, options._acceptanceAuditMaxBytes);
+            acceptanceAuditLease = acquireTelegramAcceptanceAudit(options.acceptanceReceiptRoot ?? agentRoot, options.agentName, identityKey, transportPrivateValues, scenarioHandleDigest, options._acceptanceAuditReleaseHook, options._acceptanceAuditMaxBytes);
         }
         else if (scenarioHandleDigest !== acceptanceAuditLease.scenarioHandleDigest) {
             retireAcceptanceAudit();
-            acceptanceAuditLease = acquireTelegramAcceptanceAudit(options.acceptanceReceiptRoot ?? agentRoot, options.agentName, identityKey, [botToken, authorizedUserId, authorizedChatId], scenarioHandleDigest, options._acceptanceAuditReleaseHook, options._acceptanceAuditMaxBytes);
+            acceptanceAuditLease = acquireTelegramAcceptanceAudit(options.acceptanceReceiptRoot ?? agentRoot, options.agentName, identityKey, transportPrivateValues, scenarioHandleDigest, options._acceptanceAuditReleaseHook, options._acceptanceAuditMaxBytes);
         }
         return acceptanceAuditLease;
     };
@@ -847,6 +868,17 @@ function createTelegramSenseApp(options) {
     };
     let effectJournal;
     let approvalRuntime;
+    let rootHostRuntime;
+    const approvalCoordinatorFactory = (context) => ({
+        propose: (request) => {
+            if (request.toolCall.type === "function" && request.toolCall.function.name === "sanctuary_host_execute") {
+                if (!rootHostRuntime)
+                    throw new Error("root host approval coordinator is unavailable");
+                return rootHostRuntime.coordinator(context).propose(request);
+            }
+            return approvalRuntime.coordinator(context).propose(request);
+        },
+    });
     const getEffectJournal = () => {
         effectJournal ??= new telegram_effect_adapter_1.FileTelegramEffectJournal(path.join(agentRoot, "state", "telegram", "effects"));
         return effectJournal;
@@ -959,6 +991,40 @@ function createTelegramSenseApp(options) {
             },
         }) : undefined);
         approvalTransport = options.approvalTransport ?? approvalRuntime?.transport;
+        const port = authorityTransport?.hostApproval;
+        if (useSanctuaryRuntime && port?.pins.expectedBotId === botId
+            && port.pins.expectedOwnerUserId === authorizedUserId && port.pins.expectedOwnerChatId === authorizedChatId) {
+            rootHostRuntime = (0, root_host_approval_runtime_1.createRootHostApprovalRuntime)({
+                agentRoot, port, effectBarrier: acceptanceAuditBarrier, approvalCoordinatorFactory,
+                resolveContext: async (binding) => {
+                    const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
+                    if (binding.agentRoot !== agentRoot || binding.friendId !== configuredOwnerFriendId
+                        || binding.sessionKey !== configuredOwnerSessionKey || binding.sessionPath !== sessionPath) {
+                        throw new Error("root host continuation owner session changed");
+                    }
+                    const relationshipAuthorization = await resolveLiveRelationshipAuthorization({
+                        friendId: binding.friendId, requestId: binding.requestId, sessionEventId: binding.sessionEventId,
+                        sessionKey: binding.sessionKey, botId: botId, userId: authorizedUserId, chatId: authorizedChatId,
+                    });
+                    const friendStore = new friends_1.FileFriendStore(path.join(agentRoot, "friends"));
+                    const friend = await friendStore.get(binding.friendId);
+                    if (!friend)
+                        throw new Error("root host owner Friend is unavailable");
+                    return {
+                        ...toolContext, signin: async () => undefined, agentName: options.agentName, agentRoot,
+                        currentSession: { friendId: friend.id, channel: "telegram", key: binding.sessionKey, sessionPath },
+                        context: { friend, channel: (0, friends_1.getChannelCapabilities)("telegram") }, friendStore, relationshipAuthorization,
+                        rootHost: { port },
+                    };
+                },
+                deliver: async (text, approvalId) => {
+                    await approvalEffects.sendText({
+                        idempotencyKey: `root-host:${approvalId}:continuation:${(0, node_crypto_1.createHash)("sha256").update(text).digest("hex")}`,
+                        chatId: authorizedChatId, text, authorClass: "butler",
+                    });
+                },
+            });
+        }
         interactiveControl = useSanctuaryRuntime && approvalTransport
             ? (options._createInteractiveControl ?? sanctuary_interactive_control_1.createSanctuaryInteractiveControl)({
                 agentRoot,
@@ -1020,7 +1086,10 @@ function createTelegramSenseApp(options) {
         approvalReconcileTimer = setTimeout(() => {
             approvalReconcileTimer = undefined;
             scheduleApprovalReconcile();
-            const reconciliation = runWithAcceptanceAuditOwner(() => approvalTransport.reconcileExpired()).catch((error) => {
+            const reconciliation = runWithAcceptanceAuditOwner(async () => {
+                await approvalTransport.reconcileExpired();
+                await rootHostRuntime?.recover();
+            }).catch((error) => {
                 acceptanceAuditBarrier();
                 (0, runtime_1.emitNervesEvent)({
                     level: "error",
@@ -1185,10 +1254,20 @@ function createTelegramSenseApp(options) {
                 },
                 validateTerminalAnswer: (answer) => contracts.map((contract) => contract.validateTerminalAnswer?.(answer)).find((rejection) => rejection !== undefined),
             };
+            const currentToolContext = { ...runAgentOptions.toolContext, relationshipAuthorization };
+            if (isSanctuaryOwner && rootHostRuntime && input.authority && await authorityTransport.hostApproval.refresh()) {
+                currentToolContext.rootHost = { port: authorityTransport.hostApproval, observation: input.authority };
+                try {
+                    await (0, tools_sanctuary_host_1.authorizeRootHostContext)(currentToolContext);
+                }
+                catch {
+                    delete currentToolContext.rootHost;
+                }
+            }
             return {
                 ...runAgentOptions,
                 ...(requiredToolCalls ? { requiredToolCalls } : {}),
-                toolContext: { ...runAgentOptions.toolContext, relationshipAuthorization },
+                toolContext: currentToolContext,
             };
         };
     };
@@ -1278,6 +1357,15 @@ function createTelegramSenseApp(options) {
         },
         claimFriend: options.admission.claimFriend,
         revokeFriend: options.admission.revokeFriend,
+        ...(authorityTransport ? {
+            registerCommunication: (input) => authorityTransport.admitChat({
+                admissionId: input.id,
+                updateId: input.updateId,
+                userId: input.userId,
+                chatId: input.chatId,
+            }),
+            revokeCommunication: (input) => authorityTransport.revokeChat(input),
+        } : {}),
         commitApprovedIngress: async (input) => {
             const sessionKey = `telegram:${input.botId}:${input.userId}`;
             const reference = `telegram-admission:${input.admissionId}`;
@@ -1338,8 +1426,9 @@ function createTelegramSenseApp(options) {
         const ingested = await (0, telegram_attachments_1.ingestTelegramAttachments)({
             agentName: options.agentName,
             agentRoot,
-            botToken,
+            ...(botToken ? { botToken } : {}),
             api,
+            ...(authorityTransport ? { downloadFile: authorityTransport.downloadFile } : {}),
             ...(options.attachmentFetch ? { fetch: options.attachmentFetch } : {}),
             attachments: message.attachments ?? [],
         });
@@ -1459,10 +1548,11 @@ function createTelegramSenseApp(options) {
                         chatId: message.chatId,
                         sessionKey: currentSessionKey,
                         userMessage: message.text,
+                        authority: message.authority,
                         fullVisibilityProgress: fullVisibility.progress,
                     }),
                 } : {}),
-                ...(approvalRuntime ? { approvalCoordinatorFactory: approvalRuntime.coordinator } : {}),
+                ...(approvalRuntime ? { approvalCoordinatorFactory: rootHostRuntime ? approvalCoordinatorFactory : approvalRuntime.coordinator } : {}),
             }), toolReceiptObserver);
             const result = collected.result;
             let responseFallbackArtifactId;
@@ -1517,9 +1607,9 @@ function createTelegramSenseApp(options) {
                     ...lifecycleCoordinates,
                     ...(acceptanceMarker ? {
                         outcome: "error",
-                        errorDigest: auditDigest("error", redactTelegramPrivateValues(error, [botToken, authorizedUserId, authorizedChatId, String(message.updateId), message.messageId])),
+                        errorDigest: auditDigest("error", redactTelegramPrivateValues(error, [...transportPrivateValues, String(message.updateId), message.messageId])),
                         deliveryCount: deliveredMessageIds.length,
-                    } : { error: redactTelegramPrivateValues(error, [botToken, authorizedUserId, authorizedChatId, String(message.updateId), message.messageId]) }),
+                    } : { error: redactTelegramPrivateValues(error, [...transportPrivateValues, String(message.updateId), message.messageId]) }),
                 }, Math.max(Date.now(), lifecycleStartedAt + 1)),
             });
             const fallback = "I couldn't complete that turn. The failure was recorded; please try again.";
@@ -1533,7 +1623,7 @@ function createTelegramSenseApp(options) {
                 const grounded = groundedAcceptance;
                 const schemaVersion = grounded ? "sanctuary-telegram-turn-receipt-v4" : "sanctuary-telegram-turn-receipt-v3";
                 const hmac = (purpose, value) => sanctuaryTelegramTurnReceiptDigest(identityKey, schemaVersion, purpose, value);
-                const redact = (value) => [botToken, authorizedUserId, authorizedChatId, String(message.updateId), message.messageId]
+                const redact = (value) => [...transportPrivateValues, String(message.updateId), message.messageId]
                     .reduce((text, privateValue) => privateValue.length >= 5 ? text.replaceAll(privateValue, "[REDACTED]") : text, value);
                 const deliveries = deliveredMessageIds.map((messageId, index) => {
                     const chunk = deliveredChunks[index];
@@ -1592,6 +1682,13 @@ function createTelegramSenseApp(options) {
             await admissionController.handleUnknown(message);
             return;
         }
+        // Existing household Friends need a root-observed communication binding after gateway migration.
+        await authorityTransport?.admitChat({
+            admissionId: (0, node_crypto_1.createHash)("sha256").update(`telegram-communication-v1\0${message.botId}\0${message.userId}\0${message.chatId}`).digest("hex").slice(0, 20),
+            updateId: message.updateId,
+            userId: message.userId,
+            chatId: message.chatId,
+        });
         const hydrated = await hydrateAuthorizedMessage({
             updateId: message.updateId,
             messageId: String(message.messageId),
@@ -1610,6 +1707,8 @@ function createTelegramSenseApp(options) {
     } : undefined;
     const onUpdate = async (update) => {
         const callback = update.callback_query;
+        if (callback && rootHostRuntime && await runWithAcceptanceAuditOwner(() => rootHostRuntime.handleUpdate(update)))
+            return true;
         if (callback?.data?.startsWith("admit:") && admissionController && callback.message) {
             return runWithAcceptanceAuditOwner(async () => {
                 const actor = await options.admission?.resolveOwner({ botId: botId, userId: String(callback.from.id), chatId: String(callback.message.chat.id), sessionKey: configuredOwnerSessionKey });
@@ -1643,6 +1742,10 @@ function createTelegramSenseApp(options) {
             inboxStore,
             onMessage,
             onUpdate,
+            ...(authorityTransport ? {
+                settleTransport: authorityTransport.settleTransport,
+                transportMetadata: authorityTransport.metadataForUpdate,
+            } : {}),
             acceptanceEventMeta: (update, distinctAccount) => {
                 const marker = options.acceptanceMarker ? options.acceptanceMarker() : (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)(options.agentName);
                 if (!marker)
@@ -1712,6 +1815,7 @@ function createTelegramSenseApp(options) {
                     (0, runtime_1.emitNervesEvent)({ level: "error", component: "senses", event: "senses.sanctuary_routine_recovery_error", message: "Sanctuary routine action recovery requires inspection", meta: { agentName: options.agentName, subject, category: error instanceof Error ? error.name : "unknown" } });
                 }
                 await runWithAcceptanceAuditOwner(async () => { await approvalRuntime?.recover(); });
+                await runWithAcceptanceAuditOwner(async () => { await rootHostRuntime?.recover(); });
                 await runWithAcceptanceAuditOwner(async () => { await interactiveControl?.start(); });
                 try {
                     await runWithAcceptanceAuditOwner(async () => { await approvalTransport?.reconcileExpired(); });
@@ -1813,7 +1917,7 @@ function loadTelegramSenseCredentials(agentName) {
     }
     return parseTelegramSenseCredentials(runtime.config);
 }
-async function createProductionTelegramRelationshipComposition(agentName, credentials, agentRootOverride) {
+async function createProductionTelegramRelationshipComposition(agentName, credentials, agentRootOverride, authorityTransport) {
     const agentRoot = agentRootOverride ?? (0, identity_1.getAgentRoot)(agentName);
     const botId = canonicalTelegramId(credentials.botId ?? telegramBotIdFromToken(credentials.botToken), "bot id");
     const ownerUserId = canonicalTelegramId(credentials.authorizedUserId, "authorized user id");
@@ -1922,6 +2026,7 @@ async function createProductionTelegramRelationshipComposition(agentName, creden
                 const live = await store.get(current.id);
                 if (!live || !exactTelegramIdentity(live, bindings[0].externalId))
                     throw new Error("Telegram contact identity changed");
+                await authorityTransport?.revokeChat({ userId: bindings[0].externalId, chatId: bindings[0].externalId });
                 const { capabilityProfileId: _removedProfile, ...withoutProfile } = live;
                 await store.put(live.id, { ...withoutProfile, admissionState: "revoked", initiativePolicy: "none", updatedAt: new Date().toISOString() });
                 (0, tools_awaiting_1.cancelRelationshipFollowUps)(agentRoot, agentName, { friendId: live.id, channel: "telegram", key: sessionKey });
@@ -2053,18 +2158,53 @@ async function createProductionTelegramRelationshipComposition(agentName, creden
         },
     };
 }
-async function startTelegramSenseApp(agentName) {
-    const loaded = loadTelegramSenseCredentials(agentName);
-    const credentials = { ...loaded, botId: telegramBotIdFromToken(loaded.botToken) };
-    const app = createTelegramSenseApp({
-        agentName,
-        credentials,
-        ...(await createProductionTelegramRelationshipComposition(agentName, credentials)),
-        ...(agentName === "sanctuary" ? { privilegedFailsafe: {
-                eventRoot: (0, router_1.getExternalEventRoot)(),
-                verifyProtectiveState: createSabQueueProtectiveStateVerifier(),
-            } } : {}),
-    });
+async function startTelegramSenseApp(agentName, waitForAuthority = false) {
+    let authorityTransport;
+    let credentials;
+    if (agentName === "sanctuary") {
+        const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agentName);
+        const machine = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agentName);
+        if (!runtime.ok || !machine.ok)
+            throw new Error("Sanctuary Telegram credential inventory is unavailable; migration readback is required");
+        let waiting = false;
+        for (;;) {
+            try {
+                ;
+                ({ credentials, authorityTransport } = (0, sanctuary_authority_resident_1.openSanctuaryResidentAuthority)(runtime.config, machine.config));
+                break;
+            }
+            catch (error) {
+                if (!waitForAuthority || error?.code !== "ENOENT")
+                    throw error;
+                if (!waiting) {
+                    waiting = true;
+                    (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.sanctuary_gateway_waiting", message: "Telegram is unavailable while root gateway pins are not yet published", meta: { agentName } });
+                }
+                await new Promise((resolve) => setTimeout(resolve, 1000));
+            }
+        }
+    }
+    else {
+        const loaded = loadTelegramSenseCredentials(agentName);
+        credentials = { ...loaded, botId: telegramBotIdFromToken(loaded.botToken) };
+    }
+    let app;
+    try {
+        app = createTelegramSenseApp({
+            agentName,
+            credentials,
+            authorityTransport,
+            ...(await createProductionTelegramRelationshipComposition(agentName, credentials, undefined, authorityTransport)),
+            ...(agentName === "sanctuary" ? { privilegedFailsafe: {
+                    eventRoot: (0, router_1.getExternalEventRoot)(),
+                    verifyProtectiveState: createSabQueueProtectiveStateVerifier(),
+                } } : {}),
+        });
+    }
+    catch (error) {
+        authorityTransport?.api.stop();
+        throw error;
+    }
     (0, runtime_1.emitNervesEvent)({
         component: "senses",
         event: "senses.telegram_app_ready",

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.816",
+  "version": "0.1.0-alpha.817",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.816",
+      "version": "0.1.0-alpha.817",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.816",
+  "version": "0.1.0-alpha.817",
   "engines": {
     "node": ">=22"
   },