@ouro.bot/cli 0.1.0-alpha.886 → 0.1.0-alpha.888

package/dist/senses/private-runtime.js

@@ -60,6 +60,8 @@ const tools_1 = require("../repertoire/tools");
 const tools_base_1 = require("../repertoire/tools-base");
 const tools_awaiting_1 = require("../repertoire/tools-awaiting");
 const delegated_command_1 = require("../a2a/delegated-command");
+const delegated_command_grants_1 = require("../a2a/delegated-command-grants");
+const resolution_proof_1 = require("../a2a/resolution-proof");
 const relationship_authorization_1 = require("../repertoire/relationship-authorization");
 const run_ledger_1 = require("../heart/run-ledger");
 const bundle_manifest_1 = require("../mind/bundle-manifest");
@@ -157,12 +159,17 @@ function relationshipAwaitCoordinates(awaitFile) {
 }
 /**
  * An A2A peer is reactive-only: it cannot be pushed to, and on its own it has no authority to be followed up with.
- * Only a peer still holding the operator-set principal-command grant keeps follow-up authority, and that authority
- * is the delegating owner's, resolved exactly as the delegated command resolved it. Revoking the grant ends it.
+ * Only a peer still holding the operator's trusted principal-command grant keeps follow-up authority (the same shared
+ * check admission used), and that authority is the delegating owner's, resolved exactly as the delegated command
+ * resolved it. Revoking the grant, or an expired one, ends it.
  */
 async function resolveA2APrincipal(agentRoot, store, peer, requestId) {
-    if (peer.delegationGrant?.scope !== "principal_commands" || peer.trustLevel !== "family")
-        throw new StaleRelationshipAwaitError("A2A peer no longer holds a delegation grant");
+    // TODO(phase 2 of the friends trust-layer hardening): the signer DID here is the one the friend record names, which the agent
+    // can write, so follow-up authority still trusts the record's key. Phase 2 re-verifies the signed envelope stored with the
+    // await against the grant's pinned DID instead.
+    const granted = (0, delegated_command_grants_1.checkDelegatedCommandGrant)(agentRoot, peer, (0, resolution_proof_1.friendDid)(peer));
+    if (!granted.ok)
+        throw new StaleRelationshipAwaitError(`A2A peer no longer holds a delegation grant (${granted.reason})`);
     // listAll() swallows an unreadable directory or record as "no friend": only a verified complete read may end an await.
     const entries = fs.readdirSync(path.join(agentRoot, "friends")).filter((entry) => entry.endsWith(".json"));
     const friends = await store.listAll();

package/dist/senses/shared-turn.js

@@ -47,6 +47,7 @@ exports.runSenseTurn = runSenseTurn;
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
+const delegated_command_1 = require("../a2a/delegated-command");
 const core_1 = require("../heart/core");
 const identity_1 = require("../heart/identity");
 const config_1 = require("../heart/config");
@@ -360,8 +361,11 @@ async function runSenseTurn(options) {
     });
 }
 async function runSenseTurnExclusive(options, owner) {
-    const { channel, sessionKey, friendId, userMessage } = options;
+    const { channel, sessionKey, friendId } = options;
     const { agentName, agentRoot } = owner;
+    // Only the A2A server writes the delegated-command banner, in front of a command it admitted (its body is shielded there). On every
+    // other turn, on any channel, a typed banner is marked as the sender's own words. A precommitted ingress is already stored verbatim.
+    const userMessage = options.precommittedIngress || options.toolContext?.delegatedCommand ? options.userMessage : (0, delegated_command_1.shieldDelegatedBanner)(options.userMessage);
     (0, runtime_1.emitNervesEvent)({
         component: "senses",
         event: "senses.shared_turn_start",

package/dist/senses/telegram.js

@@ -60,6 +60,7 @@ const node_async_hooks_1 = require("node:async_hooks");
 const node_fs_1 = require("node:fs");
 const path = __importStar(require("node:path"));
 const friends_1 = require("@ouro.bot/friends");
+const delegated_command_1 = require("../a2a/delegated-command");
 const identity_1 = require("../heart/identity");
 const sanctuary_acceptance_marker_1 = require("../heart/daemon/sanctuary-acceptance-marker");
 const runtime_credentials_1 = require("../heart/runtime-credentials");
@@ -1384,7 +1385,7 @@ function createTelegramSenseApp(options) {
             const sessionKey = `telegram:${input.botId}:${input.userId}`;
             const reference = `telegram-admission:${input.admissionId}`;
             const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, input.friendId, "telegram", sessionKey, agentRoot);
-            const receipt = await (0, telegram_effect_adapter_1.recordTelegramEffectsInSession)({ store: getEffectJournal(), sessionPath, artifacts: [], inbound: { text: input.text, reference } });
+            const receipt = await (0, telegram_effect_adapter_1.recordTelegramEffectsInSession)({ store: getEffectJournal(), sessionPath, artifacts: [], inbound: { text: (0, delegated_command_1.shieldDelegatedBanner)(input.text), reference } });
             return { admissionId: input.admissionId, friendId: input.friendId, sessionKey, eventId: receipt.eventId, reference };
         },
         enqueueApprovedWork: async (input) => {
@@ -1435,8 +1436,9 @@ function createTelegramSenseApp(options) {
         }
     };
     const hydrateAuthorizedMessage = async (message) => {
+        // The one place inbound Telegram text is assembled for every turn and every stored ingress event: a typed delegated-command banner is marked here, so the stored event and the turn carry identical, shielded text.
         if (!message.attachments?.length)
-            return { text: [message.text, ...(message.attachmentNotices ?? [])].filter(Boolean).join("\n"), attachmentIds: [] };
+            return { text: (0, delegated_command_1.shieldDelegatedBanner)([message.text, ...(message.attachmentNotices ?? [])].filter(Boolean).join("\n")), attachmentIds: [] };
         const ingested = await (0, telegram_attachments_1.ingestTelegramAttachments)({
             agentName: options.agentName,
             agentRoot,
@@ -1448,7 +1450,7 @@ function createTelegramSenseApp(options) {
         });
         const attachmentIds = ingested.attachments.map((attachment) => attachment.id);
         return {
-            text: [message.text, (0, render_1.renderAttachmentBlock)(ingested.attachments), ...(message.attachmentNotices ?? []), ...ingested.notices].filter(Boolean).join("\n"),
+            text: (0, delegated_command_1.shieldDelegatedBanner)([message.text, (0, render_1.renderAttachmentBlock)(ingested.attachments), ...(message.attachmentNotices ?? []), ...ingested.notices].filter(Boolean).join("\n")),
             attachmentIds,
         };
     };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.886",
+  "version": "0.1.0-alpha.888",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.886",
+      "version": "0.1.0-alpha.888",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.886",
+  "version": "0.1.0-alpha.888",
   "engines": {
     "node": ">=22"
   },