@ouro.bot/cli 0.1.0-alpha.828 → 0.1.0-alpha.829

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.829",
+      "changes": [
+        "Sanctuary authority install: the fenced vault-read restores CAP_DAC_OVERRIDE and copies the credential store into a writable tmpfs, so the root migration can read the resident-owned vault instead of failing with a masked permission error."
+      ]
+    },
     {
       "version": "0.1.0-alpha.828",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.828",
+  "runtimeVersion": "0.1.0-alpha.829",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.828</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.829</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -732,15 +732,29 @@ class SanctuaryAuthorityRootLifecycle {
         }
     }
     #vault(operation, input) {
+        // The fenced container runs root with every capability dropped, but the
+        // resident credential store is owned by the resident uid (10001), so a bare
+        // cap-dropped root cannot even read it (EACCES on agent.json → surfaces as
+        // "vault owner unavailable"). CAP_DAC_OVERRIDE is restored — the single
+        // capability needed to read the resident's files, nothing broader — and the
+        // read-only bitwarden app-data is copied into a writable tmpfs inside the
+        // container before the CLI runs, because bitwarden cannot unlock a store it
+        // cannot write to. The copy stays inside the container's own tmpfs, so the
+        // fence still never writes to resident state. `operation` is one of the four
+        // fixed literals validated by the CLI, never external input.
+        const cli = "/opt/ouro/dist/heart/daemon/sanctuary-authority-root-lifecycle.js";
         return JSON.parse(this.#docker([
-            "run", "--rm", "-i", "--pull=never", "--network", "host", "--user", "0:0", "--read-only", "--cap-drop=ALL",
-            "--security-opt=no-new-privileges", "--entrypoint", "/usr/local/bin/node",
+            "run", "--rm", "-i", "--pull=never", "--network", "host", "--user", "0:0", "--read-only",
+            "--cap-drop=ALL", "--cap-add=DAC_OVERRIDE", "--security-opt=no-new-privileges", "--entrypoint", "/bin/sh",
             "--mount", `type=bind,src=${RUNTIME},dst=/home/ouro/.ouro-cli,readonly`,
+            "--mount", `type=bind,src=${RUNTIME}/bitwarden,dst=/home/ouro/.bw-src,readonly`,
             "--mount", `type=bind,src=${BUNDLE},dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly`,
             "--tmpfs", "/home/ouro/.ouro-cli/bitwarden:rw,nosuid,nodev,noexec,mode=0700",
+            "--tmpfs", "/home/ouro/.config:rw,nosuid,nodev,noexec,mode=0700",
             "--tmpfs", "/tmp:rw,nosuid,nodev,noexec,mode=0700",
             "--env", `OURO_AUTHORITY_REMOVE_INTERLOCK=${this.#request.epochId}`,
-            this.#transaction.targetImageId, "/opt/ouro/dist/heart/daemon/sanctuary-authority-root-lifecycle.js", "vault", operation,
+            this.#transaction.targetImageId, "-c",
+            `cp -r /home/ouro/.bw-src/. /home/ouro/.ouro-cli/bitwarden/ && exec /usr/local/bin/node ${cli} vault ${operation}`,
         ], input === undefined ? undefined : JSON.stringify(input)));
     }
 }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.828",
+  "version": "0.1.0-alpha.829",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.828",
+      "version": "0.1.0-alpha.829",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.828",
+  "version": "0.1.0-alpha.829",
   "engines": {
     "node": ">=22"
   },