@ouro.bot/cli 0.1.0-alpha.843 → 0.1.0-alpha.845

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.845",
+      "changes": [
+        "Senses: a turn that errors now tells the person so instead of going silent (naming the step limit when that is the cause). This was the mechanism behind the Butler's answer-then-greet sequence (D-004): a question hit the provider step limit (D-007), nothing was sent, and each prod became its own turn. The engine still refuses to answer without evidence; the private channel stays silent."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.844",
+      "changes": [
+        "Sanctuary authority start is faster and no longer blind (D-036): package verification walks the tree once without following symlinks and then reads each file with O_NOFOLLOW, instead of resolving every file's real path (on Unraid that was two-thirds of each pass: about 15 s instead of about 47 s per pass, and a gateway start runs two), and the gateway's own output now goes to a root-only, size-capped gateway.log in the authority directory instead of nowhere.",
+        "Sanctuary: the agent's own view of its senses reports the tokenless root-authority Telegram as ready (it said needs_config while Telegram worked), and a token found in the resident's config as needs_config, matching the daemon's rule (D-047)."
+      ]
+    },
     {
       "version": "0.1.0-alpha.843",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.843",
+  "runtimeVersion": "0.1.0-alpha.845",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.843</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.845</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-installation.js

@@ -58,8 +58,12 @@ function directory(filePath, uid, gid, mode) {
         throw new Error("Sanctuary authority installation directory metadata changed");
     }
 }
-function readOwned(filePath, uid, gid, mode) {
-    canonical(filePath);
+/** `trustedParent`: the caller already walked every parent directory without following
+ * symlinks, so only the leaf needs guarding, and O_NOFOLLOW does that. Resolving each
+ * package file's real path cost two-thirds of every verification on Unraid (D-036). */
+function readOwned(filePath, uid, gid, mode, trustedParent = false) {
+    if (!trustedParent)
+        canonical(filePath);
     const descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
     try {
         const stat = fs.fstatSync(descriptor);
@@ -102,8 +106,6 @@ function verifySanctuaryAuthorityInstallation(input) {
             || typeof pin.digest !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(pin.digest) || ![0o600, 0o644, 0o700, 0o755].includes(pin.mode)) {
             throw new Error("Sanctuary authority package file pin is invalid");
         }
-        if (digest(readOwned(path.join(input.packageRoot, relative), uid, gid, pin.mode)) !== pin.digest)
-            throw new Error("Sanctuary authority package file digest changed");
     }
     const actual = [];
     const walk = (relative) => {
@@ -125,6 +127,13 @@ function verifySanctuaryAuthorityInstallation(input) {
     walk("");
     if (JSON.stringify(actual.sort()) !== JSON.stringify(expected))
         throw new Error("Sanctuary authority package inventory changed");
+    // The walk above reached every file through real (not symlinked) directories, so a
+    // file read only needs to refuse a symlinked leaf.
+    for (const relative of expected) {
+        const pin = manifest.files[relative];
+        if (digest(readOwned(path.join(input.packageRoot, relative), uid, gid, pin.mode, true)) !== pin.digest)
+            throw new Error("Sanctuary authority package file digest changed");
+    }
     const controllers = ["cpu", "memory", "pids"];
     const readControl = (name) => fs.readFileSync(path.join(input.cgroupRoot, name), "utf8").trim();
     for (const name of ["cgroup.controllers", "cgroup.subtree_control"]) {

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -73,6 +73,7 @@ const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 // page cache on Unraid's array that takes minutes, so readiness gets a generous budget
 // (a 120 s budget failed a real rollback on 2026-09-24).
 const GATEWAY_READY_TIMEOUT_MS = 900_000;
+const GATEWAY_LOG_MAX_BYTES = 5 * 1024 * 1024;
 const TEMPLATE_JOURNAL = "/boot/config/custom/ouro-butler/docker-man-template-transaction.json";
 // In-place upgrade of an installed authority: same epoch (token, issuer, cursor,
 // gateway state), new reviewed package and resident image. Every root record it
@@ -536,9 +537,16 @@ class SanctuaryAuthorityRootLifecycle {
             throw new Error("Sanctuary root token custody is not exclusive");
         if (this.#pid() === null) {
             this.#remove(`${this.#epochRoot()}/readiness.json`);
-            const child = (0, node_child_process_1.spawn)(this.#p("/usr/local/bin/node"), [this.#p(`${ROOT}/package/dist/heart/daemon/sanctuary-telegram-authority-entry.js`), "--config", this.#p(`${ROOT}/active.json`)], {
-                cwd: "/", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }, detached: true, stdio: "ignore",
-            });
+            const log = this.#gatewayLog();
+            let child;
+            try {
+                child = (0, node_child_process_1.spawn)(this.#p("/usr/local/bin/node"), [this.#p(`${ROOT}/package/dist/heart/daemon/sanctuary-telegram-authority-entry.js`), "--config", this.#p(`${ROOT}/active.json`)], {
+                    cwd: "/", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }, detached: true, stdio: ["ignore", log, log],
+                });
+            }
+            finally {
+                fs.closeSync(log);
+            }
             child.unref();
             let failed = false;
             child.once("error", () => { failed = true; });
@@ -551,6 +559,17 @@ class SanctuaryAuthorityRootLifecycle {
         else
             await this.#wait(() => this.#ready(), GATEWAY_READY_TIMEOUT_MS);
     }
+    /** The gateway's own output, kept root-only beside the token it guards and capped at two
+     * generations. It used to go nowhere, so a gateway that exited at startup said nothing
+     * (D-036: finding "host cgroup entry is invalid" took a hand-run gateway). */
+    #gatewayLog() {
+        const file = this.#p(`${ROOT}/gateway.log`);
+        if (fs.existsSync(file) && fs.statSync(file).size > GATEWAY_LOG_MAX_BYTES)
+            fs.renameSync(file, `${file}.1`);
+        const fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | fs.constants.O_NOFOLLOW, 0o600);
+        fs.fchmodSync(fd, 0o600);
+        return fd;
+    }
     #target() {
         const target = this.#containers().find((container) => container.Name === "/ouro-butler");
         if (!target || target.Image !== this.#transaction.targetImageId || target.Config.User !== "10001:10001"

package/dist/heart/turn-context.js

@@ -212,9 +212,14 @@ function readSenseStatusLines() {
                 ? openAIRealtimeVoiceReady
                 : cascadeVoiceReady,
         a2a: true,
-        telegram: hasTextField(runtimePayload, "telegramBotToken")
-            && hasTextField(runtimePayload, "telegramAuthorizedUserId")
-            && hasTextField(runtimePayload, "telegramAuthorizedChatId"),
+        // Sanctuary's resident is deliberately tokenless: the root authority gateway holds the
+        // token, so a token in the resident's config would be the misconfiguration. Mirror the
+        // daemon's rule (sense-manager) instead of reporting a working sense as needs_config (D-047).
+        telegram: agentName === "sanctuary"
+            ? runtimeConfig.ok && machineRuntimeConfig.ok && !Object.hasOwn(runtimePayload, "telegramBotToken") && !Object.hasOwn(machinePayload, "telegramBotToken")
+            : hasTextField(runtimePayload, "telegramBotToken")
+                && hasTextField(runtimePayload, "telegramAuthorizedUserId")
+                && hasTextField(runtimePayload, "telegramAuthorizedChatId"),
         workbench: false,
     };
     const rows = [

package/dist/senses/shared-turn.js

@@ -42,6 +42,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.stripThinkBlocks = stripThinkBlocks;
 exports.extractOutwardSenseDeliveryText = extractOutwardSenseDeliveryText;
 exports.getSenseSessionPath = getSenseSessionPath;
+exports.erroredTurnReply = erroredTurnReply;
 exports.runSenseTurn = runSenseTurn;
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -333,6 +334,17 @@ function getSenseSessionPath(agentName, friendId, channel, sessionKey, agentRoot
  * Caller provides channel, session key, friend, and message;
  * this function handles all pipeline wiring.
  */
+/**
+ * What an outward sense says when a turn errors and provider failover has nothing to say.
+ * Such turns used to end in silence: the owner saw no reply, prodded, and later got
+ * the late answer followed by a greeting to a prod (D-004); the step-limit stop was the
+ * observed cause (D-007). The engine still refuses to answer without evidence.
+ */
+function erroredTurnReply(errorMessage) {
+    return /iteration limit exhausted/u.test(errorMessage ?? "")
+        ? "I couldn't finish that one: I ran out of steps before I had an answer I could stand behind. Ask me again, or ask something narrower, and I'll take another run at it."
+        : "I couldn't finish that one: something went wrong before I had an answer. Ask me again and I'll retry.";
+}
 async function runSenseTurn(options) {
     return (0, turn_execution_lease_1.withTurnExecutionLease)(async () => {
         const owner = Object.freeze({ agentName: options.agentName, agentRoot: (0, identity_1.getAgentRoot)(options.agentName) });
@@ -453,6 +465,7 @@ async function runSenseTurnExclusive(options, owner) {
             // once the turn completes.
             let committedResponseText = "";
             let pendingResponseText = "";
+            let terminalErrorMessage;
             let terminalDeliveryKind = "text";
             const deliveries = [];
             const deliveryFailures = [];
@@ -535,6 +548,8 @@ async function runSenseTurnExclusive(options, owner) {
                     emitFrontendEvent({ type: "tool_completed", data: { name, summary: _summary, success } });
                 },
                 onError: (error, severity) => {
+                    if (severity === "terminal")
+                        terminalErrorMessage = error.message;
                     emitFrontendEvent({ type: "error", data: { message: error.message, severity } });
                 },
                 onClearText: () => {
@@ -661,7 +676,9 @@ async function runSenseTurnExclusive(options, owner) {
             const eventView = currentTurnEventView(terminalEvents, existingEventIds, userMessage, options.precommittedIngress, options.ingressRelations);
             let finalDeliveryKind = terminalDeliveryKind;
             const acceptedTerminalOutcome = turnResult.turnOutcome === "settled" || turnResult.turnOutcome === "blocked";
-            const failoverText = turnResult.turnOutcome === "errored" ? turnResult.failoverMessage?.trim() : undefined;
+            const failoverText = turnResult.turnOutcome === "errored"
+                ? turnResult.failoverMessage?.trim() || (channel === "inner" ? undefined : erroredTurnReply(terminalErrorMessage))
+                : undefined;
             const expectsOutwardResponse = acceptedTerminalOutcome || turnResult.turnOutcome === "command" || Boolean(failoverText);
             let finalCausalCoordinate;
             if (acceptedTerminalOutcome) {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.843",
+  "version": "0.1.0-alpha.845",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.843",
+      "version": "0.1.0-alpha.845",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.843",
+  "version": "0.1.0-alpha.845",
   "engines": {
     "node": ">=22"
   },