@ouro.bot/cli 0.1.0-alpha.893 → 0.1.0-alpha.895

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.895",
+      "changes": [
+        "The vault unlocks once per machine. Each agent's folder under ~/.ouro-cli/bitwarden/ now keeps one disposable bw profile per installed bw version (bw-<version>/), so machines with several bw installs never migrate or share one profile. When a local step fails on an authenticated profile (a null KdfConfig or missing master-password unlock data after a newer bw half-migrated it, or a missing session), Ouro moves the profile aside as data.json.discarded and logs in fresh once with the saved unlock secret, without asking the human. Server steps (login, sync), network errors, rate limits (429), gateway errors (502/504), connection resets, DNS and unreachable-network failures, lock contention and rejected secrets never discard a profile, and those network failures now count as transient. Ouro no longer deletes the saved Keychain/DPAPI/Secret Service/plaintext unlock entry when the vault rejects it: it keeps the entry and writes a private rejection record (mode 0600) in the agent's bw folder that every process honors, so no process retries a rejected secret against the server; `ouro vault unlock` (even with the same secret) or any successful login clears it. A store's terminal login failure is retried after 15 minutes instead of being held until restart. The locked-vault message also names a macOS password reset, which replaces the login keychain, as a cause. The Unraid template and the Sanctuary bundle runtime move to this version."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.894",
+      "changes": [
+        "The cmux sense can answer a Claude Code permission prompt 'once' for the human, and only when every code check agrees: an allowlist floor over the request's structured fields (in-repo edits, a short table of read-only commands each with its own allowed options, read-only git when the repository's git config runs no programs, and the repository's own checks as exact words; everything else escalates), no 'ask me' precedent, cmux 0.65.0 or later, and a standing owner grant (cmux.feed.once) for that repository under its count cap. Before replying it re-checks the request and records the reply under the decision log's lock, and it counts the reply as made only when cmux shows the request resolved 'once'. Two new family-only tools: cmux_reply_once records the agent's judgment (shadow only unless the code allows the reply) and cmux_correct records the human's exact precedent, refusing in autonomous turns and during external events and accepting 'once' only for a request the human allowed in cmux. Decisions and precedents stay machine-local, with digests of command words and field-by-field redaction; first-format precedents are migrated to digests, and an unreadable casebook makes the sense escalate everything rather than skip an 'ask'. A reply whose call failed, or whose request expired, goes back to the human, a request is never replied to twice, a stale decision-log lock is taken over through a per-contender tombstone that is checked to be the stale lock, an unreadable decision log or a torn line makes the count cap refuse rather than count zero, a torn last line is ended before the next append, and reply records survive log rotation for 31 days, the longest grant window allowed. Questions, plan approvals, Codex and Copilot always go to the human. No human-run command issues the grant yet, so in v1 the sense escalates every request."
+      ]
+    },
     {
       "version": "0.1.0-alpha.893",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.893",
+  "runtimeVersion": "0.1.0-alpha.895",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.893</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.895</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/steward-policy.js

@@ -38,6 +38,7 @@ exports.assertNotReplayIdentity = assertNotReplayIdentity;
 exports.updateStewardPolicy = updateStewardPolicy;
 exports.readRoutineActionReceipts = readRoutineActionReceipts;
 exports.inspectRoutineActionGrant = inspectRoutineActionGrant;
+exports.inspectStandingActionGrant = inspectStandingActionGrant;
 exports.consumeRoutineActionGrant = consumeRoutineActionGrant;
 exports.withStewardPolicyLease = withStewardPolicyLease;
 exports.withRoutineActionAttempt = withRoutineActionAttempt;
@@ -524,6 +525,31 @@ function inspectRoutineActionGrant(agentRoot, input) {
         return { allowed: false, reason: error instanceof Error ? error.message : "routine action policy is unavailable" };
     }
 }
+function inspectStandingActionGrant(agentRoot, input) {
+    try {
+        const { policy, rows } = readPolicyState(agentRoot);
+        const now = input.now ?? new Date().toISOString();
+        const grant = policy.routineActionGrants[input.key];
+        if (!grant)
+            return { allowed: false, reason: "standing grant is missing" };
+        if (grant.provenance !== "stated")
+            return { allowed: false, reason: "standing grant must be owner-stated" };
+        if (!appliedEntry(rows, ["grant_routine_action"], input.key, grant))
+            return { allowed: false, reason: "standing grant has no applied owner authorization" };
+        if (grant.action !== input.action)
+            return { allowed: false, reason: "action does not match the standing grant" };
+        if (!grant.targets.includes(input.target) || grant.exclusions.includes(input.target))
+            return { allowed: false, reason: "target is not covered by the standing grant" };
+        if (grant.expiresAt && Date.parse(grant.expiresAt) <= Date.parse(now))
+            return { allowed: false, reason: "standing grant expired" };
+        if (input.usesInWindow(grant.windowMs) >= grant.maxCount)
+            return { allowed: false, reason: "standing grant count cap reached" };
+        return { allowed: true, grantVersion: grant.version, maxCount: grant.maxCount, windowMs: grant.windowMs };
+    }
+    catch (error) {
+        return { allowed: false, reason: error instanceof Error ? error.message : "steward policy is unavailable" };
+    }
+}
 function consumeRoutineActionGrant(agentRoot, input) {
     if (!text(input.authorizationReceiptId))
         throw new Error("routine action requires a current authorization receipt");

package/dist/repertoire/bitwarden-store.js

@@ -43,6 +43,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BitwardenCredentialStore = void 0;
 exports.sanitizeCredentialErrorDetail = sanitizeCredentialErrorDetail;
+exports.readBwCliVersion = readBwCliVersion;
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -169,6 +170,7 @@ const BW_LOCK_STALE_MS = BW_LOCK_TIMEOUT_MS * 2;
 const BW_DATA_FILENAME = "data.json";
 const BW_SYNC_MARKER_FILENAME = ".ouro-last-sync";
 const BW_SYNC_FRESH_MS = 60_000;
+const BW_TERMINAL_LOGIN_ERROR_RETRY_MS = 15 * 60_000;
 /** In-process async mutex keyed by appDataDir. */
 const inProcessLocks = new Map();
 function isPidAlive(pid) {
@@ -365,6 +367,58 @@ function isBwNotInstalled(err) {
     const code = err.code;
     return code === "ENOENT" || /\bspawn\b.*\benoent\b/.test(msg) || msg.includes("command not found");
 }
+/**
+ * Read the installed @bitwarden/cli version from the package that owns the
+ * resolved `bw` binary. Returns null when the binary is not an npm install.
+ */
+function readBwCliVersion(bwBinaryPath) {
+    let dir;
+    try {
+        dir = path.dirname(fs.realpathSync(bwBinaryPath));
+    }
+    catch {
+        return null;
+    }
+    for (let depth = 0; depth < 4; depth++) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+            if (pkg.name === "@bitwarden/cli" && typeof pkg.version === "string")
+                return pkg.version;
+        }
+        catch {
+            // Keep walking up toward the package root.
+        }
+        dir = path.dirname(dir);
+    }
+    return null;
+}
+/** Another process holds the profile; the profile itself is not at fault. */
+function isBwLockTimeout(err) {
+    return err.message.includes("bw CLI lock timeout");
+}
+/**
+ * A local bw step (unlock of an already-authenticated profile) failed for a
+ * reason that says nothing about the vault server: the profile on disk is
+ * unusable. Network, lock and missing-binary failures are not this, and
+ * neither is a rejected unlock secret.
+ */
+class LocalProfileUnusableError extends Error {
+    localError;
+    constructor(localError) {
+        super(localError.message);
+        this.localError = localError;
+    }
+}
+function asLocalProfileFailure(err) {
+    if (isTransientError(err) || isBwNotInstalled(err) || isBwLockTimeout(err) || isBwInvalidUnlockSecretMessage(err.message)) {
+        return err;
+    }
+    return new LocalProfileUnusableError(err);
+}
+/** A bw version as a safe directory name component. */
+function bwProfileDirName(version) {
+    return `bw-${version.replace(/[^A-Za-z0-9._-]/g, "_")}`;
+}
 /** Check if the error is transient (network/timeout) and worth retrying. */
 function isTransientError(err) {
     const msg = err.message.toLowerCase();
@@ -372,7 +426,18 @@ function isTransientError(err) {
         msg.includes("etimedout") ||
         msg.includes("enotfound") ||
         msg.includes("socket hang up") ||
+        msg.includes("econnreset") ||
+        msg.includes("eai_again") ||
+        msg.includes("enetunreach") ||
+        msg.includes("ehostunreach") ||
+        msg.includes("fetch failed") ||
+        msg.includes("429") ||
+        msg.includes("too many requests") ||
+        msg.includes("502") ||
         msg.includes("503") ||
+        msg.includes("504") ||
+        msg.includes("bad gateway") ||
+        msg.includes("gateway timeout") ||
         msg.includes("server unavailable") ||
         msg.includes("timed out"));
 }
@@ -491,17 +556,22 @@ class BitwardenCredentialStore {
     serverUrl;
     email;
     masterPassword;
+    /** The agent's bw folder; each bw version keeps its own profile under it. */
+    agentDataDir;
+    /** The profile directory for the running bw version (BITWARDENCLI_APPDATA_DIR). */
     appDataDir;
     onInvalidUnlockSecret;
     onLoginSuccess;
     sessionToken = null;
     terminalLoginError = null;
+    terminalLoginErrorAt = 0;
     bwBinaryPath = "bw";
     structuredItemCache = null;
     constructor(serverUrl, email, masterPassword, options = {}) {
         this.serverUrl = serverUrl;
         this.email = email;
         this.masterPassword = masterPassword;
+        this.agentDataDir = options.appDataDir;
         this.appDataDir = options.appDataDir;
         this.onInvalidUnlockSecret = options.onInvalidUnlockSecret;
         this.onLoginSuccess = options.onLoginSuccess;
@@ -543,11 +613,21 @@ class BitwardenCredentialStore {
      */
     async login() {
         if (this.terminalLoginError) {
-            throw this.terminalLoginError;
+            // A long-lived process retries a terminal failure after a while instead
+            // of holding it until restart; rejected secrets are paused separately.
+            if (Date.now() - this.terminalLoginErrorAt < BW_TERMINAL_LOGIN_ERROR_RETRY_MS) {
+                throw this.terminalLoginError;
+            }
+            this.terminalLoginError = null;
         }
         // Ensure bw CLI is installed before any bw commands
         this.bwBinaryPath = await (0, bw_installer_1.ensureBwCli)();
-        if (this.appDataDir) {
+        if (this.agentDataDir) {
+            // Each bw version gets its own profile directory, so machines with
+            // several bw installs (one per Node version) never migrate or fight
+            // over one another's state.
+            const bwVersion = readBwCliVersion(this.bwBinaryPath);
+            this.appDataDir = bwVersion ? path.join(this.agentDataDir, bwProfileDirName(bwVersion)) : this.agentDataDir;
             fs.mkdirSync(this.appDataDir, { recursive: true, mode: 0o700 });
         }
         let lastError;
@@ -562,7 +642,7 @@ class BitwardenCredentialStore {
                 lastError = err instanceof Error ? err : new Error(String(err));
                 // Don't retry non-transient errors (auth failures, bw not installed)
                 if (!isTransientError(lastError)) {
-                    this.terminalLoginError = lastError;
+                    this.setTerminalLoginError(lastError);
                     if (isBwInvalidUnlockSecretMessage(lastError.message)) {
                         await this.notifyInvalidUnlockSecret(lastError);
                     }
@@ -581,15 +661,76 @@ class BitwardenCredentialStore {
                 await delay(backoffMs);
             }
         }
-        this.terminalLoginError = lastError;
+        this.setTerminalLoginError(lastError);
         /* v8 ignore next -- invalid unlock errors are non-transient and exit through the non-retry path above @preserve */
         if (isBwInvalidUnlockSecretMessage(lastError.message)) {
             await this.notifyInvalidUnlockSecret(lastError);
         }
         throw lastError;
     }
-    /** Single login attempt — called by login() retry loop. */
+    setTerminalLoginError(error) {
+        this.terminalLoginError = error;
+        this.terminalLoginErrorAt = Date.now();
+    }
+    /**
+     * Single login attempt — called by login() retry loop.
+     *
+     * The bw profile directory is a disposable cache; the durable secret is the
+     * machine's vault unlock material. When a local step fails on an
+     * authenticated profile (a corrupt or half-migrated profile, a missing
+     * session), the profile is moved aside and rebuilt with one fresh login.
+     * Server steps (login, sync), network failures, lock contention and
+     * rejected secrets never discard the profile, so a bad secret or a flaky
+     * server costs at most one server login per attempt.
+     */
     async loginAttempt() {
+        try {
+            await this.loginWithLocalProfile();
+        }
+        catch (error) {
+            if (!(error instanceof LocalProfileUnusableError))
+                throw error;
+            await this.discardLocalProfile(error.localError);
+            try {
+                await this.loginWithLocalProfile();
+            }
+            catch (retryError) {
+                throw retryError instanceof LocalProfileUnusableError ? retryError.localError : retryError;
+            }
+        }
+    }
+    /**
+     * Move the local bw profile aside so the next bw command starts from an
+     * empty profile. The previous data file is kept as one `.discarded` copy
+     * for diagnosis and is overwritten by the next discard.
+     */
+    async discardLocalProfile(cause) {
+        const appDataDir = this.appDataDir;
+        this.sessionToken = null;
+        this.structuredItemCache = null;
+        await withBwLock(appDataDir, async () => {
+            const dataPath = path.join(appDataDir, BW_DATA_FILENAME);
+            try {
+                fs.renameSync(dataPath, `${dataPath}.discarded`);
+            }
+            catch {
+                // Already gone: another process discarded it first, which is the same outcome.
+            }
+            fs.rmSync(path.join(appDataDir, BW_SYNC_MARKER_FILENAME), { force: true });
+        });
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "repertoire.bw_local_profile_discarded",
+            component: "repertoire",
+            message: "discarded unusable local bw profile; logging in fresh with the saved unlock secret",
+            meta: {
+                email: this.email,
+                serverUrl: this.serverUrl,
+                error: sanitizeCredentialErrorDetail(cause.message),
+            },
+        });
+    }
+    async loginWithLocalProfile() {
         let status = await this.readStatus();
         if (this.shouldRebuildLocalProfile(status)) {
             await this.rebuildLocalProfile("local bw profile did not match requested vault", status);
@@ -692,7 +833,12 @@ class BitwardenCredentialStore {
             const err = error;
             if (!isBwAlreadyLoggedInError(err))
                 throw err;
-            return this.execBwWithPasswordEnv(["unlock", "--raw"]);
+        }
+        try {
+            return await this.execBwWithPasswordEnv(["unlock", "--raw"]);
+        }
+        catch (error) {
+            throw asLocalProfileFailure(error);
         }
     }
     forgetLocalSyncMarker() {
@@ -754,7 +900,7 @@ class BitwardenCredentialStore {
         catch (error) {
             const err = error;
             if (!isBwInvalidUnlockSecretMessage(err.message))
-                throw err;
+                throw asLocalProfileFailure(err);
             await this.rebuildLocalProfile(reason, status, err);
             /* v8 ignore next -- defensive: rebuildLocalProfile always stores a string session token on success @preserve */
             return this.sessionToken ?? "";

package/dist/repertoire/credential-access.js

@@ -46,15 +46,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getCredentialStore = getCredentialStore;
 exports.probeCredentialVaultAccess = probeCredentialVaultAccess;
 exports.resetCredentialStore = resetCredentialStore;
-const crypto = __importStar(require("node:crypto"));
 const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const runtime_1 = require("../nerves/runtime");
 const identity = __importStar(require("../heart/identity"));
 const bitwarden_store_1 = require("./bitwarden-store");
 const vault_unlock_1 = require("./vault-unlock");
 let stores = new Map();
+function rejectedUnlockMessage(agentName, reason) {
+    return [
+        `The vault rejected the unlock secret saved on this machine for ${agentName} (${reason}).`,
+        "The saved secret was kept. If the vault's unlock secret changed, run",
+        `\`ouro vault unlock --agent ${agentName}\` once with the current secret.`,
+    ].join(" ");
+}
 function loadVaultSectionForAgent(agentName) {
     const configPath = path.join(identity.getAgentRoot(agentName), "agent.json");
     try {
@@ -65,14 +70,6 @@ function loadVaultSectionForAgent(agentName) {
         return { configPath };
     }
 }
-function bitwardenAppDataDir(agentName, vaultConfig, homeDir = os.homedir()) {
-    const digest = crypto
-        .createHash("sha256")
-        .update(`${agentName}:${vaultConfig.serverUrl}:${vaultConfig.email}`)
-        .digest("hex")
-        .slice(0, 24);
-    return path.join(homeDir, ".ouro-cli", "bitwarden", digest);
-}
 function getCredentialStore(agentNameInput) {
     const agentName = agentNameInput ?? identity.getAgentName();
     if (agentName === "SerpentGuide") {
@@ -87,6 +84,11 @@ function getCredentialStore(agentNameInput) {
     const cached = stores.get(cacheKey);
     if (cached)
         return cached;
+    const agentDataDir = (0, vault_unlock_1.bitwardenAppDataDir)(agentName, vaultConfig);
+    const rejection = (0, vault_unlock_1.readVaultUnlockRejection)(agentDataDir);
+    if (rejection) {
+        throw new Error(rejectedUnlockMessage(agentName, rejection.reason));
+    }
     const unlock = (0, vault_unlock_1.readVaultUnlockSecret)({
         agentName,
         email: vaultConfig.email,
@@ -94,25 +96,22 @@ function getCredentialStore(agentNameInput) {
     });
     const unlockConfig = { agentName, email: vaultConfig.email, serverUrl: vaultConfig.serverUrl };
     const unlockSource = unlock.source ?? unlockConfig;
-    let invalidUnlockCleared = false;
     let canonicalUnlockStored = false;
     const store = new bitwarden_store_1.BitwardenCredentialStore(vaultConfig.serverUrl, vaultConfig.email, unlock.secret, {
-        appDataDir: bitwardenAppDataDir(agentName, vaultConfig),
+        appDataDir: agentDataDir,
         onInvalidUnlockSecret: (error) => {
-            if (invalidUnlockCleared)
-                return;
-            invalidUnlockCleared = true;
-            (0, vault_unlock_1.clearVaultUnlockSecret)({
-                agentName,
-                email: unlockSource.email,
-                serverUrl: unlockSource.serverUrl,
-            });
+            // The vault rejected the saved secret. Keep the saved secret: deleting
+            // the only durable copy turns any misclassified bw or server error
+            // into a human prompt. Record the rejection on disk so no process
+            // retries it against the server; `ouro vault unlock` or any
+            // successful login clears the record.
             stores.delete(cacheKey);
+            (0, vault_unlock_1.recordVaultUnlockRejection)(agentDataDir, error.message);
             (0, runtime_1.emitNervesEvent)({
                 level: "warn",
-                event: "repertoire.credential_store_invalid_unlock_cleared",
+                event: "repertoire.credential_store_unlock_rejected",
                 component: "repertoire",
-                message: "cleared rejected local vault unlock material",
+                message: "vault rejected the saved local unlock secret; kept it and paused retries until a new secret is saved",
                 meta: {
                     agentName,
                     serverUrl: vaultConfig.serverUrl,
@@ -123,6 +122,7 @@ function getCredentialStore(agentNameInput) {
             });
         },
         onLoginSuccess: () => {
+            (0, vault_unlock_1.clearVaultUnlockRejection)(agentDataDir);
             if (canonicalUnlockStored)
                 return;
             if (unlockSource.serverUrl === vaultConfig.serverUrl && unlockSource.email === vaultConfig.email)
@@ -170,7 +170,11 @@ async function probeCredentialVaultAccess(agentNameInput, unlockSecret, options
         throw new Error((0, vault_unlock_1.credentialVaultNotConfiguredError)(agentName, configPath));
     }
     const vaultConfig = identity.resolveVaultConfig(agentName, vault);
-    const store = new bitwarden_store_1.BitwardenCredentialStore(vaultConfig.serverUrl, vaultConfig.email, unlockSecret, { appDataDir: bitwardenAppDataDir(agentName, vaultConfig, options.homeDir) });
+    const agentDataDir = (0, vault_unlock_1.bitwardenAppDataDir)(agentName, vaultConfig, options.homeDir);
+    const store = new bitwarden_store_1.BitwardenCredentialStore(vaultConfig.serverUrl, vaultConfig.email, unlockSecret, {
+        appDataDir: agentDataDir,
+        onLoginSuccess: () => (0, vault_unlock_1.clearVaultUnlockRejection)(agentDataDir),
+    });
     await store.get("__ouro_vault_probe__");
 }
 function resetCredentialStore() {

package/dist/repertoire/guardrails.js

@@ -443,7 +443,7 @@ const COMMERCE_FAMILY_TOOLS = new Set(["commerce_checkout_preview", "commerce_ch
 const COMMERCE_AUTHORITY_TOOLS = new Set(["stripe_create_card", "flight_hold", "flight_book"]);
 // The cmux tools read the owner's terminals and speak to them through their desktop, so only family may use them.
 // A call with no known trust level fails closed.
-const CMUX_FAMILY_TOOLS = new Set(["cmux_overview", "cmux_read", "cmux_signal"]);
+const CMUX_FAMILY_TOOLS = new Set(["cmux_overview", "cmux_read", "cmux_signal", "cmux_reply_once", "cmux_correct"]);
 const MAIL_FAMILY_TOOLS = new Set(["mail_screener", "mail_decide", "mail_access_log", "mail_send", "mail_index_refresh"]);
 const MAIL_DELEGATED_READ_TOOLS = new Set(["mail_recent", "mail_search"]);
 function opaqueAnsiShellAtoms(command) {

package/dist/repertoire/tools-cmux.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cmuxToolDefinitions = exports.cmuxSignalToolDefinition = exports.cmuxReadToolDefinition = exports.cmuxOverviewToolDefinition = exports.CMUX_STATUS_KEY = void 0;
+exports.cmuxToolDefinitions = exports.cmuxCorrectToolDefinition = exports.cmuxReplyOnceToolDefinition = exports.cmuxSignalToolDefinition = exports.cmuxReadToolDefinition = exports.cmuxOverviewToolDefinition = exports.CMUX_STATUS_KEY = void 0;
 exports.cmuxToolsEnabled = cmuxToolsEnabled;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -41,7 +41,10 @@ const cmux_config_1 = require("../heart/cmux-config");
 const runtime_credentials_1 = require("../heart/runtime-credentials");
 const runtime_1 = require("../nerves/runtime");
 const attention_1 = require("../senses/cmux/attention");
+const answer_1 = require("../senses/cmux/answer");
+const casebook_1 = require("../senses/cmux/casebook");
 const client_1 = require("../senses/cmux/client");
+const principles_1 = require("../senses/cmux/principles");
 const redact_1 = require("../senses/cmux/redact");
 /**
  * The cmux sense's tools: who needs the human (`cmux_overview`), what a terminal shows
@@ -117,6 +120,7 @@ async function overview(ctx) {
         (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.cmux_overview", message: "read cmux overview", meta: { workspaces: workspaces.length, waiting: pending.length } });
         return JSON.stringify({
             sense: { connected: state.connected, lastError: state.lastError, cmuxVersion: state.cmuxVersion },
+            principles: (0, principles_1.readCmuxPrinciples)(ctx.agentRoot),
             waitingOnHuman: pending.map((item) => {
                 const where = refFor((0, attention_1.surfaceForSession)(state, item.workstreamId)?.surfaceId);
                 return {
@@ -274,4 +278,119 @@ exports.cmuxSignalToolDefinition = {
     summaryKeys: ["workspace", "status", "notify_title"],
     riskProfile: { mutates: "external_side_effect", risk: "high", reason: "changes what cmux shows the human (sidebar status or a desktop notification)" },
 };
-exports.cmuxToolDefinitions = [exports.cmuxOverviewToolDefinition, exports.cmuxReadToolDefinition, exports.cmuxSignalToolDefinition];
+function answerContext(ctx, client) {
+    const stateDir = (0, answer_1.cmuxStateDir)(ctx.agentRoot);
+    return { agentRoot: ctx.agentRoot, stateDir, client, now: Date.now, cmuxVersion: () => (0, attention_1.readCmuxState)(path.join(stateDir, "state.json"), new Date().toISOString()).cmuxVersion };
+}
+exports.cmuxReplyOnceToolDefinition = {
+    tool: {
+        type: "function",
+        function: {
+            name: "cmux_reply_once",
+            description: "Record your judgment that a coding agent's pending permission request is routine and fine to allow once. Your judgment alone never sends anything: the reply goes out only when the code floor, the human's exact precedent and a standing owner grant all allow it, and then only as 'once'. Otherwise your judgment is logged in shadow for the human to review and the request stays with them. Questions, plan approvals, Codex and Copilot requests always stay with the human.",
+            parameters: {
+                type: "object",
+                properties: {
+                    request_id: { type: "string", description: "The Feed request id from the escalation or cmux_overview." },
+                    reasoning: { type: "string", description: "Why this is routine under the cmux principles, in one or two sentences." },
+                },
+                required: ["request_id", "reasoning"],
+                additionalProperties: false,
+            },
+        },
+    },
+    handler: async (args, ctx) => {
+        const requestId = text(args.request_id).trim();
+        const reasoning = text(args.reasoning).trim();
+        if (!requestId || !reasoning)
+            return JSON.stringify({ error: "give the request_id and your reasoning" });
+        const client = clientFor(ctx);
+        if (typeof client === "string")
+            return JSON.stringify({ error: client });
+        try {
+            const item = (0, attention_1.pendingFeedItems)(await client.call("feed.list", { pending_only: true })).find((entry) => entry.requestId === requestId);
+            if (!item)
+                return JSON.stringify({ error: `request ${requestId} is no longer pending` });
+            const answers = answerContext(ctx, client);
+            const judgment = (0, answer_1.judgeFeedItem)(answers, item);
+            if (judgment.reply) {
+                const outcome = await (0, answer_1.answerOnce)(answers, item, judgment);
+                return JSON.stringify({ sent: outcome === "replied_once", outcome, authority: judgment.authority, ...(outcome === "replied_once" || outcome === "race" ? {} : { next: "The request stays with the human; tell them with cmux_signal if it is urgent." }) });
+            }
+            (0, answer_1.recordDecision)(answers, item, judgment, "shadow", `agent would allow once: ${reasoning}`);
+            (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.cmux_shadow_judgment", message: "logged the agent's would-be cmux answer in shadow", meta: { tool: item.toolName } });
+            return JSON.stringify({ sent: false, outcome: "shadow", reason: judgment.reason, next: "The request stays with the human; tell them with cmux_signal if it is urgent." });
+        }
+        catch (error) {
+            return failure("cmux_reply_once", error);
+        }
+    },
+    summaryKeys: ["request_id"],
+    riskProfile: { mutates: "external_side_effect", risk: "high", reason: "may answer a coding agent's permission request once when the floor, a precedent and a standing grant allow it" },
+};
+exports.cmuxCorrectToolDefinition = {
+    tool: {
+        type: "function",
+        function: {
+            name: "cmux_correct",
+            description: "Record the human's answer or correction for a coding-agent request the cmux sense judged, as an exact precedent on this machine. 'once' means the human is fine with exactly this request being allowed once next time, and is accepted only when cmux shows the human allowed that request themselves; 'ask' means always ask them about exactly this request. Use it only for what the human actually said, in conversation with them; it is refused in autonomous turns and while handling an external event. A precedent never overrides the code floor, and live replies still need a standing owner grant.",
+            parameters: {
+                type: "object",
+                properties: {
+                    request_id: { type: "string", description: "The Feed request id the human answered or corrected." },
+                    verdict: { type: "string", enum: ["once", "ask"], description: "once: fine to allow once next time. ask: always ask." },
+                    note: { type: "string", description: "What the human said, briefly." },
+                },
+                required: ["request_id", "verdict", "note"],
+                additionalProperties: false,
+            },
+        },
+    },
+    handler: async (args, ctx) => {
+        const requestId = text(args.request_id).trim();
+        const verdict = args.verdict;
+        if (!requestId || (verdict !== "once" && verdict !== "ask"))
+            return JSON.stringify({ error: "give the request_id and a verdict of once or ask" });
+        if (!ctx?.agentRoot)
+            return JSON.stringify({ error: "the cmux tools need an agent runtime" });
+        if (ctx.currentExternalEvent || ctx.autonomousTurnKind)
+            return JSON.stringify({ error: "cmux_correct records what the human said in conversation; it cannot run in an autonomous turn or while handling an external event" });
+        const stateDir = (0, answer_1.cmuxStateDir)(ctx.agentRoot);
+        const decisions = (0, casebook_1.readDecisions)((0, casebook_1.cmuxDecisionLogPath)(stateDir)).filter((entry) => entry.requestId === requestId);
+        const decision = [...decisions].reverse().find((entry) => entry.shape);
+        if (!decision)
+            return JSON.stringify({ error: `no judged request ${requestId} with a precedent shape; the floor escalates it unconditionally or it was never seen` });
+        const shape = decision.shape;
+        if (!(0, casebook_1.isShape)(shape))
+            return JSON.stringify({ error: `the logged shape for ${requestId} is from an older format and cannot become a precedent; record it again after the sense judges the request anew` });
+        if (verdict === "once") {
+            // A "once" precedent turns into live authority later, so it must rest on the human's own answer in cmux, not on ours.
+            if (decisions.some((entry) => entry.outcome === "reply_sent" || entry.outcome === "replied_once"))
+                return JSON.stringify({ error: `the sense itself replied to ${requestId}; only a request the human answered can become a once precedent` });
+            const client = clientFor(ctx);
+            if (typeof client === "string")
+                return JSON.stringify({ error: client });
+            try {
+                const status = await (0, answer_1.feedItemStatus)(client, requestId);
+                if (status?.status !== "resolved" || status.kind !== "permission" || !status.mode || status.mode === "deny") {
+                    return JSON.stringify({ error: `cmux does not show the human allowing ${requestId} (${status ? `${status.status}${status.mode ? `, ${status.mode}` : ""}` : "not listed"}); record 'ask' instead, or wait until they answer it in cmux` });
+                }
+            }
+            catch (error) {
+                return failure("cmux_correct", error);
+            }
+        }
+        let entry;
+        try {
+            entry = (0, casebook_1.addCase)((0, casebook_1.cmuxCasebookPath)(stateDir), { verdict, shape, requestId, note: text(args.note), at: new Date().toISOString() });
+        }
+        catch (error) {
+            return failure("cmux_correct", error);
+        }
+        (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.cmux_correct", message: "recorded the human's cmux precedent", meta: { verdict } });
+        return JSON.stringify({ case: entry.id, verdict, tool: entry.shape.tool, repoRoot: entry.shape.repoRoot });
+    },
+    summaryKeys: ["request_id", "verdict"],
+    riskProfile: { mutates: "durable_state_write", risk: "high", reason: "records a precedent that later decides whether a coding agent's request is answered" },
+};
+exports.cmuxToolDefinitions = [exports.cmuxOverviewToolDefinition, exports.cmuxReadToolDefinition, exports.cmuxSignalToolDefinition, exports.cmuxReplyOnceToolDefinition, exports.cmuxCorrectToolDefinition];