@ouro.bot/cli 0.1.0-alpha.823 → 0.1.0-alpha.825

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.825",
+      "changes": [
+        "Sanctuary: a single nested emphasis no longer makes a whole Butler reply render as literal asterisks."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.824",
+      "changes": [
+        "Sanctuary: vault removal is reachable only from the authority install transaction, so the destructive verb can no longer be run bare against a host with no root authority installed."
+      ]
+    },
     {
       "version": "0.1.0-alpha.823",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.823",
+  "runtimeVersion": "0.1.0-alpha.825",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.823</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.825</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -739,6 +739,7 @@ class SanctuaryAuthorityRootLifecycle {
             "--mount", `type=bind,src=${BUNDLE},dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly`,
             "--tmpfs", "/home/ouro/.ouro-cli/bitwarden:rw,nosuid,nodev,noexec,mode=0700",
             "--tmpfs", "/tmp:rw,nosuid,nodev,noexec,mode=0700",
+            "--env", `OURO_AUTHORITY_REMOVE_INTERLOCK=${this.#request.epochId}`,
             this.#transaction.targetImageId, "/opt/ouro/dist/heart/daemon/sanctuary-authority-root-lifecycle.js", "vault", operation,
         ], input === undefined ? undefined : JSON.stringify(input)));
     }
@@ -748,6 +749,17 @@ async function runSanctuaryAuthorityRootCli(argv, write = (text) => process.stdo
     if (process.getuid() !== 0 || process.getgid() !== 0)
         throw new Error("Sanctuary root lifecycle requires root");
     if (argv.length === 2 && argv[0] === "vault") {
+        // `remove` is the one vault verb that can strand the household. It is safe
+        // only inside the install transaction, which has already proven the same
+        // token into root custody at `verify-token-rotation`. Run bare against a
+        // host with no installed root authority it leaves the Butler with no route
+        // to Telegram at all, which is how Sanctuary lost its front door on
+        // 2026-09-21. This is a safety interlock against invoking it outside its
+        // transaction, not a privilege boundary: root can always set the variable,
+        // but it can no longer do this by reaching for a documented verb.
+        if (argv[1] === "remove" && !process.env.OURO_AUTHORITY_REMOVE_INTERLOCK) {
+            throw new Error("Sanctuary vault removal runs only inside the authority install transaction; use docker-man-template-transaction.mjs authority-install");
+        }
         const input = argv[1] === "restore" ? JSON.parse(fs.readFileSync(0, "utf8")) : undefined;
         write(`${JSON.stringify(await (0, sanctuary_authority_vault_migration_1.migrateSanctuaryAuthorityVault)(argv[1], input))}\n`);
         return;

package/dist/senses/telegram-effect-adapter.js

@@ -76,25 +76,54 @@ function preparedTexts(effect) {
         return [requireText(effect.text, "Telegram text")];
     return [effect.text?.trim() || null];
 }
+// Bold spans may carry one level of emphasis inside them, because `**bold with
+// *italic* inside**` is ordinary model prose. The inner span is rendered by the
+// same conservative scan, so a bold run that does not resolve cleanly still
+// degrades the whole message to literal text rather than emitting partial
+// markup. Everything else stays as strict as before: a span must open on a
+// letter or digit and close on a non-space, which is what keeps `**/src/**`,
+// `2 ** 3` and `a_b_c` literal.
+const TELEGRAM_BOLD_WITH_NESTING = /`([^`\n]+)`|\*\*([\p{L}\p{N}](?:[^*_`\n]|\*(?!\*)|_)*\S|[\p{L}\p{N}])\*\*|\*([\p{L}\p{N}](?:[^*_`\n]*\S)?)\*|_([\p{L}\p{N}](?:[^*_`\n]*\S)?)_/gu;
+const TELEGRAM_EMPHASIS_ONLY = /`([^`\n]+)`|\*([\p{L}\p{N}](?:[^*_`\n]*\S)?)\*|_([\p{L}\p{N}](?:[^*_`\n]*\S)?)_/gu;
 function renderTelegramButlerHtml(text) {
+    return renderTelegramStyledSpan(text, true) ?? (0, telegram_client_1.escapeTelegramHtml)(text);
+}
+// Returns null when the span cannot be rendered cleanly, so every caller falls
+// back to escaping rather than emitting half-applied markup.
+function renderTelegramStyledSpan(text, allowBold) {
     let html = "";
     let cursor = 0;
-    const styledText = /`([^`\n]+)`|\*\*([\p{L}\p{N}](?:[^*_`\n]*\S)?)\*\*|\*([\p{L}\p{N}](?:[^*_`\n]*\S)?)\*|_([\p{L}\p{N}](?:[^*_`\n]*\S)?)_/gu;
-    for (const match of text.matchAll(styledText)) {
+    const pattern = allowBold ? TELEGRAM_BOLD_WITH_NESTING : TELEGRAM_EMPHASIS_ONLY;
+    pattern.lastIndex = 0;
+    for (const match of text.matchAll(pattern)) {
         const gap = text.slice(cursor, match.index);
         if (/[*_`]/u.test(gap))
-            return (0, telegram_client_1.escapeTelegramHtml)(text);
+            return null;
         html += (0, telegram_client_1.escapeTelegramHtml)(gap);
-        if (match[1] !== undefined)
-            html += `<code>${(0, telegram_client_1.escapeTelegramHtml)(match[1])}</code>`;
-        else if (match[2] !== undefined || match[3] !== undefined)
-            html += `<b>${(0, telegram_client_1.escapeTelegramHtml)((match[2] ?? match[3]))}</b>`;
+        const code = match[1];
+        const bold = allowBold ? match[2] : undefined;
+        const italic = allowBold ? match[3] : match[2];
+        const underscored = allowBold ? match[4] : match[3];
+        if (code !== undefined)
+            html += `<code>${(0, telegram_client_1.escapeTelegramHtml)(code)}</code>`;
+        else if (bold !== undefined) {
+            const inner = renderTelegramStyledSpan(bold, false);
+            if (inner === null)
+                return null;
+            html += `<b>${inner}</b>`;
+            // A single-marker span is bold at the top level, which is the long-standing
+            // convention here, but inside a bold run it is the nested emphasis the
+            // author meant - and nesting <b> in <b> would be markup Telegram has no
+            // reason to accept.
+        }
+        else if (italic !== undefined)
+            html += allowBold ? `<b>${(0, telegram_client_1.escapeTelegramHtml)(italic)}</b>` : `<i>${(0, telegram_client_1.escapeTelegramHtml)(italic)}</i>`;
         else
-            html += `<i>${(0, telegram_client_1.escapeTelegramHtml)(match[4])}</i>`;
+            html += `<i>${(0, telegram_client_1.escapeTelegramHtml)(underscored)}</i>`;
         cursor = match.index + match[0].length;
     }
     const tail = text.slice(cursor);
-    return /[*_`]/u.test(tail) ? (0, telegram_client_1.escapeTelegramHtml)(text) : html + (0, telegram_client_1.escapeTelegramHtml)(tail);
+    return /[*_`]/u.test(tail) ? null : html + (0, telegram_client_1.escapeTelegramHtml)(tail);
 }
 function assertEffectTarget(target, effect, idempotencyKey) {
     if (target.kind === "admission_gate") {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.823",
+  "version": "0.1.0-alpha.825",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.823",
+      "version": "0.1.0-alpha.825",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.823",
+  "version": "0.1.0-alpha.825",
   "engines": {
     "node": ">=22"
   },