@ouro.bot/cli 0.1.0-alpha.829 → 0.1.0-alpha.830

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.830",
+      "changes": [
+        "Persist authority vault writes (remove-resident-token, rollback restore-token-cursor) by binding the real bitwarden store writable in the fence, not a throwaway tmpfs copy; reads still use the copy. Fixes the install stranding after transfer-cursor."
+      ]
+    },
     {
       "version": "0.1.0-alpha.829",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.829",
+  "runtimeVersion": "0.1.0-alpha.830",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.829</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.830</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -736,25 +736,38 @@ class SanctuaryAuthorityRootLifecycle {
         // resident credential store is owned by the resident uid (10001), so a bare
         // cap-dropped root cannot even read it (EACCES on agent.json → surfaces as
         // "vault owner unavailable"). CAP_DAC_OVERRIDE is restored — the single
-        // capability needed to read the resident's files, nothing broader — and the
-        // read-only bitwarden app-data is copied into a writable tmpfs inside the
-        // container before the CLI runs, because bitwarden cannot unlock a store it
-        // cannot write to. The copy stays inside the container's own tmpfs, so the
-        // fence still never writes to resident state. `operation` is one of the four
-        // fixed literals validated by the CLI, never external input.
+        // capability needed to reach the resident's files, nothing broader.
+        //
+        // bitwarden cannot unlock (or sync) a store it cannot write to, so the store
+        // dir must be writable inside the fence. The two verbs split by intent:
+        //   • snapshot / presence are READS: the read-only store is copied into a
+        //     throwaway tmpfs, so the fence never mutates resident state.
+        //   • remove / restore are WRITES whose whole purpose is to change the vault
+        //     (remove-resident-token, rollback restore-token-cursor). They bind the
+        //     real ${RUNTIME}/bitwarden writable (rw over the read-only .ouro-cli),
+        //     so the edit — and bitwarden's own sync-on-unlock — persists. Copying to
+        //     tmpfs here would silently discard the write and fail the step's readback.
+        // `operation` is one of the four fixed literals validated by the CLI.
         const cli = "/opt/ouro/dist/heart/daemon/sanctuary-authority-root-lifecycle.js";
+        const persists = operation === "remove" || operation === "restore";
+        const bitwarden = persists
+            ? ["--mount", `type=bind,src=${RUNTIME}/bitwarden,dst=/home/ouro/.ouro-cli/bitwarden`]
+            : [
+                "--mount", `type=bind,src=${RUNTIME}/bitwarden,dst=/home/ouro/.bw-src,readonly`,
+                "--tmpfs", "/home/ouro/.ouro-cli/bitwarden:rw,nosuid,nodev,noexec,mode=0700",
+            ];
+        const prepare = persists ? "" : "cp -r /home/ouro/.bw-src/. /home/ouro/.ouro-cli/bitwarden/ && ";
         return JSON.parse(this.#docker([
             "run", "--rm", "-i", "--pull=never", "--network", "host", "--user", "0:0", "--read-only",
             "--cap-drop=ALL", "--cap-add=DAC_OVERRIDE", "--security-opt=no-new-privileges", "--entrypoint", "/bin/sh",
             "--mount", `type=bind,src=${RUNTIME},dst=/home/ouro/.ouro-cli,readonly`,
-            "--mount", `type=bind,src=${RUNTIME}/bitwarden,dst=/home/ouro/.bw-src,readonly`,
+            ...bitwarden,
             "--mount", `type=bind,src=${BUNDLE},dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly`,
-            "--tmpfs", "/home/ouro/.ouro-cli/bitwarden:rw,nosuid,nodev,noexec,mode=0700",
             "--tmpfs", "/home/ouro/.config:rw,nosuid,nodev,noexec,mode=0700",
             "--tmpfs", "/tmp:rw,nosuid,nodev,noexec,mode=0700",
             "--env", `OURO_AUTHORITY_REMOVE_INTERLOCK=${this.#request.epochId}`,
             this.#transaction.targetImageId, "-c",
-            `cp -r /home/ouro/.bw-src/. /home/ouro/.ouro-cli/bitwarden/ && exec /usr/local/bin/node ${cli} vault ${operation}`,
+            `${prepare}exec /usr/local/bin/node ${cli} vault ${operation}`,
         ], input === undefined ? undefined : JSON.stringify(input)));
     }
 }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.829",
+  "version": "0.1.0-alpha.830",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.829",
+      "version": "0.1.0-alpha.830",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.829",
+  "version": "0.1.0-alpha.830",
   "engines": {
     "node": ">=22"
   },