@ouro.bot/cli 0.1.0-alpha.893 → 0.1.0-alpha.895

package/dist/senses/cmux/floor.js

@@ -0,0 +1,407 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findRepoRoot = findRepoRoot;
+exports.resolveInsideRepo = resolveInsideRepo;
+exports.tokenizeCommand = tokenizeCommand;
+exports.gitConfigHazard = gitConfigHazard;
+exports.evaluateFloor = evaluateFloor;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+const realFs = {
+    exists: (target) => fs.existsSync(target),
+    realpath: (target) => fs.realpathSync(target),
+    read: (target) => {
+        try {
+            return fs.readFileSync(target, "utf-8");
+        }
+        catch {
+            return null;
+        }
+    },
+};
+const MAX_COMMAND_CHARS = 2_000;
+const EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+const READ_TOOLS = new Set(["Read", "Glob", "Grep", "LS"]);
+/** Characters that chain, pipe, redirect, substitute, expand or escape anywhere in the command, quoted or not. */
+const SHELL_CONTROL = /[\n\r;&|`$<>(){}\\!#]/;
+/** Characters the shell expands as a glob when they appear outside quotes. */
+const GLOB = /[*?[\]]/;
+const PROTECTED_SEGMENTS = new Set([".git", ".claude", ".github", ".husky", ".vscode", ".idea"]);
+const PROTECTED_NAMES = new Set([
+    "package.json", ".npmrc", ".yarnrc", ".yarnrc.yml", ".mcp.json", ".gitmodules", ".gitattributes", ".gitconfig",
+    ".bashrc", ".bash_profile", ".bash_login", ".profile", ".zshrc", ".zshenv", ".zprofile", ".zlogin", ".envrc",
+    "claude.md", "agents.md", "copilot-instructions.md",
+]);
+/** Protected paths that can hold credentials: even reading them escalates. */
+const CREDENTIAL_TOUCHES = new Set(["touches an environment file", "touches .git", "touches .npmrc", "touches .yarnrc", "touches .yarnrc.yml", "touches .gitconfig", "touches .envrc", "touches .claude"]);
+/** Programs never answered for the human, even with a precedent: they delete, escalate, reach the network, wrap or run other programs. */
+const HARD_COMMANDS = new Set([
+    "rm", "rmdir", "unlink", "shred", "dd", "mkfs", "diskutil", "chmod", "chown", "chgrp", "chflags", "xattr", "mv", "cp", "ln", "install", "tee", "truncate",
+    "sudo", "su", "doas", "kill", "killall", "pkill", "launchctl", "shutdown", "reboot", "halt", "crontab", "defaults", "security", "osascript", "open",
+    "curl", "wget", "ssh", "scp", "sftp", "rsync", "nc", "ncat", "netcat", "telnet", "ftp", "socat", "gh", "az", "aws", "gcloud", "kubectl", "terraform", "docker", "fly", "vercel", "heroku",
+    "sh", "bash", "zsh", "fish", "dash", "ksh", "csh", "tcsh", "eval", "exec", "source", ".", "env", "xargs", "nohup", "time", "timeout", "nice", "caffeinate", "watch", "command", "builtin", "script", "expect", "at", "batch",
+    "npx", "pnpx", "bunx", "ouro", "cmux", "claude", "codex", "copilot", "base64", "openssl", "gpg", "date", "less", "more", "vi", "vim", "nano", "emacs",
+]);
+/** Programs that run code they are handed: a precedent may answer them only with no options at all. */
+const INTERPRETERS = new Set(["python", "python3", "node", "ruby", "perl", "php", "deno", "lua", "swift", "awk", "gawk", "sed", "jq", "make"]);
+const PACKAGE_MANAGERS = new Set(["npm", "pnpm", "yarn", "bun", "pip", "pip3", "pipx", "brew", "gem", "cargo", "go", "uv", "poetry", "composer"]);
+/** The repository's own checks, allowed only as these exact words. */
+const TEST_COMMANDS = [
+    ["npm", "test"], ["npm", "run", "test"], ["npm", "run", "lint"], ["npm", "run", "typecheck"],
+    ["swift", "test"], ["swift", "build"], ["cargo", "test"], ["cargo", "check"], ["go", "test"], ["go", "vet"],
+];
+const flags = (letters, values = {}) => ({ ...Object.fromEntries([...letters].map((letter) => [letter, "flag"])), ...values });
+const longFlags = (names, values = {}) => ({ ...Object.fromEntries(names.map((name) => [name, "flag"])), ...values });
+const GREP = {
+    short: flags("rRnilvwcEFHhosx", { e: "text", m: "num", A: "num", B: "num", C: "num" }),
+    long: longFlags(["--line-number", "--ignore-case", "--recursive", "--count", "--files-with-matches", "--fixed-strings", "--word-regexp"], { "--include": "text", "--exclude": "text", "--exclude-dir": "text" }),
+};
+const COMMANDS = {
+    ls: { short: flags("1aAlhRtrSdF"), long: longFlags(["--all", "--human-readable", "--recursive"]) },
+    pwd: { noPositional: true },
+    cat: { short: flags("n") },
+    head: { short: { n: "num", c: "num" }, digits: true },
+    tail: { short: { n: "num", c: "num" }, digits: true },
+    wc: { short: flags("lwcm") },
+    grep: GREP, egrep: GREP, fgrep: GREP,
+    rg: {
+        short: flags("inlwcFSuvHo", { g: "text", t: "text", e: "text", m: "num", A: "num", B: "num", C: "num" }),
+        long: longFlags(["--hidden", "--files", "--fixed-strings", "--ignore-case", "--line-number", "--count", "--files-with-matches", "--no-ignore"], { "--glob": "text", "--type": "text" }),
+    },
+    find: { long: longFlags(["-print", "-empty"], { "-name": "text", "-iname": "text", "-type": "text", "-maxdepth": "num", "-mindepth": "num" }) },
+    tree: { short: flags("adf", { L: "num" }) },
+    file: { short: flags("b") },
+    stat: {},
+    diff: { short: flags("uqrN") },
+    which: { short: flags("a") },
+    echo: { short: flags("n") },
+    du: { short: flags("sh", { d: "num" }) },
+    true: { noPositional: true },
+};
+/** Read-only git subcommands and their options. Any other git subcommand escalates. */
+const GIT = {
+    status: { short: flags("sb"), long: longFlags(["--short", "--branch", "--porcelain"]) },
+    log: { short: { n: "num" }, digits: true, long: longFlags(["--oneline", "--decorate", "--graph"], { "--max-count": "num" }) },
+    diff: { long: longFlags(["--name-only", "--name-status", "--cached", "--staged", "--no-ext-diff", "--no-textconv"]) },
+    show: { long: longFlags(["--name-only", "--name-status", "--oneline", "--no-ext-diff", "--no-textconv"]) },
+    "rev-parse": { long: longFlags(["--show-toplevel", "--abbrev-ref", "--short", "--is-inside-work-tree"]) },
+    "ls-files": { long: longFlags(["--others", "--exclude-standard", "--cached", "--modified"]) },
+    branch: { short: flags("arv"), long: longFlags(["--all", "--remotes", "--verbose", "--show-current"]), noPositional: true },
+    "merge-base": {},
+    "rev-list": { long: longFlags(["--count"]) },
+    describe: { long: longFlags(["--tags", "--always"]) },
+};
+/** Repository git config keys and sections that make read-only git commands run a program. */
+const GIT_CONFIG_HAZARD = /^\s*(?:fsmonitor|external|textconv|pager|sshcommand|hookspath|askpass|editor|clean|smudge|process|command|cmd|helper|program|tool)\s*=|^\s*\[\s*(?:include|includeif|filter|alias)\b/im;
+function hard(reason) {
+    return { verdict: "hard", reason };
+}
+function parseObject(text) {
+    if (text === null)
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The nearest ancestor of `cwd` (after resolving symlinks) that holds a `.git` entry. */
+function findRepoRoot(cwd, fsx = realFs) {
+    if (!path.isAbsolute(cwd) || !fsx.exists(cwd))
+        return null;
+    let dir = fsx.realpath(cwd);
+    for (;;) {
+        if (fsx.exists(path.join(dir, ".git")))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * The repo-relative path of `target` after resolving `..` and every symlink on the part of the path
+ * that exists, or null when it lands outside the repository. A `~` path is never resolved.
+ */
+function resolveInsideRepo(repoRoot, cwd, target, fsx = realFs) {
+    if (target.startsWith("~"))
+        return null;
+    let existing = path.resolve(cwd, target);
+    const rest = [];
+    while (!fsx.exists(existing)) {
+        rest.unshift(path.basename(existing));
+        existing = path.dirname(existing);
+    }
+    const resolved = path.join(fsx.realpath(existing), ...rest);
+    if (resolved === repoRoot)
+        return ".";
+    if (!resolved.startsWith(`${repoRoot}${path.sep}`))
+        return null;
+    return path.relative(repoRoot, resolved);
+}
+function protectedPath(relative) {
+    const segments = relative.split(path.sep).map((segment) => segment.toLowerCase());
+    const protectedSegment = segments.find((segment) => PROTECTED_SEGMENTS.has(segment));
+    if (protectedSegment)
+        return `touches ${protectedSegment}`;
+    const name = segments[segments.length - 1];
+    if (PROTECTED_NAMES.has(name))
+        return `touches ${name}`;
+    if (name.startsWith(".env"))
+        return "touches an environment file";
+    return null;
+}
+/**
+ * Shell words for a single simple command, or null when quoting is unbalanced. `globbed` is true when
+ * a glob character appears outside quotes. Escapes and expansions are refused before this runs.
+ */
+function tokenizeCommand(command) {
+    const tokens = [];
+    let current = "";
+    let started = false;
+    let quote = null;
+    let globbed = false;
+    for (const char of command) {
+        if (quote) {
+            if (char === quote)
+                quote = null;
+            else
+                current += char;
+            continue;
+        }
+        if (char === "'" || char === "\"") {
+            quote = char;
+            started = true;
+            continue;
+        }
+        if (/\s/.test(char)) {
+            if (started)
+                tokens.push(current);
+            current = "";
+            started = false;
+            continue;
+        }
+        if (GLOB.test(char))
+            globbed = true;
+        current += char;
+        started = true;
+    }
+    if (quote)
+        return null;
+    if (started)
+        tokens.push(current);
+    return { tokens, globbed };
+}
+/** Whether repository git config could make a read-only git command run a program. Unreadable config counts. */
+function gitConfigHazard(repoRoot, fsx = realFs) {
+    const pointer = fsx.read(path.join(repoRoot, ".git"));
+    const gitDir = pointer === null ? path.join(repoRoot, ".git") : path.resolve(repoRoot, pointer.replace(/^gitdir:\s*/, "").trim());
+    const common = fsx.read(path.join(gitDir, "commondir"));
+    const configs = [path.join(gitDir, "config"), path.join(gitDir, "config.worktree"), ...(common ? [path.join(path.resolve(gitDir, common.trim()), "config")] : [])];
+    const texts = configs.map((file) => fsx.read(file));
+    if (texts[0] === null && (common === null || texts[2] === null))
+        return true;
+    return texts.some((text) => text !== null && GIT_CONFIG_HAZARD.test(text));
+}
+function checkWord(repoRoot, cwd, word, fsx) {
+    const relative = resolveInsideRepo(repoRoot, cwd, word, fsx);
+    return relative === null ? { outside: true, touches: null } : { outside: false, touches: protectedPath(relative) };
+}
+/** Null when every option is on the command's list and every value fits its kind; otherwise the reason. */
+function checkOptions(spec, args, positional) {
+    const value = (kind, text, name) => {
+        if (text === undefined)
+            return `${name} is missing its value`;
+        if (kind === "num" ? !/^\d+$/.test(text) : text.includes("/") || text.startsWith("~"))
+            return `${name} has a value the floor does not accept`;
+        return null;
+    };
+    let endOfOptions = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (endOfOptions || !arg.startsWith("-") || arg === "-") {
+            const reason = spec.noPositional ? "takes no arguments here" : positional(arg);
+            if (reason)
+                return reason;
+            continue;
+        }
+        if (arg === "--") {
+            endOfOptions = true;
+            continue;
+        }
+        const equals = arg.indexOf("=");
+        const name = equals > 0 ? arg.slice(0, equals) : arg;
+        const longKind = spec.long?.[name];
+        if (longKind) {
+            if (longKind === "flag") {
+                if (equals > 0)
+                    return `${name} takes no value`;
+                continue;
+            }
+            const reason = value(longKind, equals > 0 ? arg.slice(equals + 1) : args[++index], name);
+            if (reason)
+                return reason;
+            continue;
+        }
+        if (arg.startsWith("--"))
+            return `${name} is not on the allowlist`;
+        if (spec.digits && /^-\d+$/.test(arg))
+            continue;
+        for (let at = 1; at < arg.length; at += 1) {
+            const letter = arg[at];
+            const kind = spec.short?.[letter];
+            if (!kind)
+                return `-${letter} is not on the allowlist`;
+            if (kind === "flag")
+                continue;
+            const attached = arg.slice(at + 1);
+            const reason = value(kind, attached || args[++index], `-${letter}`);
+            if (reason)
+                return reason;
+            break;
+        }
+    }
+    return null;
+}
+function bashVerdict(command, repoRoot, cwd, fsx) {
+    if (typeof command !== "string" || !command.trim())
+        return hard("no command to judge");
+    if (command.length > MAX_COMMAND_CHARS)
+        return hard("command is too long to judge");
+    if (SHELL_CONTROL.test(command))
+        return hard("command chains, pipes, redirects, substitutes or expands");
+    const parsed = tokenizeCommand(command);
+    if (!parsed || parsed.tokens.length === 0)
+        return hard("command quoting does not parse");
+    if (parsed.globbed)
+        return hard("command has an unquoted glob");
+    const tokens = parsed.tokens;
+    const [program, ...args] = tokens;
+    const name = program.toLowerCase();
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(program))
+        return hard("command sets environment variables");
+    if (HARD_COMMANDS.has(name))
+        return hard(`${name} is never answered for the human`);
+    // Every word, and every value glued to an option, must stay inside the repository; credential paths escalate.
+    let touches = null;
+    for (const arg of args) {
+        const values = arg.startsWith("-") ? [arg.includes("=") ? arg.slice(arg.indexOf("=") + 1) : arg.slice(2)] : [arg];
+        for (const word of values.filter((entry) => entry.includes("/") || entry.startsWith("~") || !arg.startsWith("-"))) {
+            const check = checkWord(repoRoot, cwd, word, fsx);
+            if (check.outside)
+                return hard("command reaches outside the repository");
+            if (!arg.startsWith("-"))
+                touches ??= check.touches;
+        }
+    }
+    if (touches && CREDENTIAL_TOUCHES.has(touches))
+        return hard(`command ${touches}`);
+    const shape = { repoRoot, tool: "Bash", tokens };
+    if (TEST_COMMANDS.some((entry) => entry.length === tokens.length && entry.every((token, index) => token === tokens[index])))
+        return { verdict: "allow", reason: "runs the repository's own checks", shape };
+    if (name === "git") {
+        const subcommand = args[0] ?? "";
+        const spec = GIT[subcommand];
+        if (!spec)
+            return hard(`git ${subcommand || "with global options"} is never answered for the human`);
+        if (gitConfigHazard(repoRoot, fsx))
+            return hard("the repository's git config can run programs");
+        const reason = checkOptions(spec, args.slice(1), () => null);
+        return reason ? hard(`git ${subcommand}: ${reason}`) : { verdict: "allow", reason: `git ${subcommand} only reads`, shape };
+    }
+    const spec = COMMANDS[name];
+    if (spec && !program.includes("/")) {
+        const reason = checkOptions(spec, args, () => null);
+        return reason ? hard(`${name}: ${reason}`) : { verdict: "allow", reason: `${name} only reads`, shape };
+    }
+    if (PACKAGE_MANAGERS.has(name)) {
+        const script = (args[0] === "run" && args.length === 2) || (args[0] === "test" && args.length === 1);
+        if (!script)
+            return hard(`${name} ${args[0] ?? ""} is never answered for the human`.trim());
+    }
+    if ((INTERPRETERS.has(name) || /^python\d/.test(name)) && args.some((arg) => arg.startsWith("-")))
+        return hard(`${name} with options can run inline code`);
+    if (touches)
+        return hard(`command ${touches}`);
+    return { verdict: "soft", reason: program.includes("/") ? "runs a program by path" : `${name} is not on the allowlist`, shape };
+}
+function pathVerdict(tool, input, repoRoot, cwd, fsx) {
+    const raw = input.file_path ?? input.notebook_path ?? input.path ?? (READ_TOOLS.has(tool) ? cwd : undefined);
+    if (typeof raw !== "string" || !raw.trim())
+        return hard(`${tool} names no path`);
+    const relative = resolveInsideRepo(repoRoot, cwd, raw, fsx);
+    if (relative === null)
+        return hard(`${tool} reaches outside the repository`);
+    const blocked = protectedPath(relative);
+    if (blocked && (EDIT_TOOLS.has(tool) || CREDENTIAL_TOUCHES.has(blocked)))
+        return hard(`${tool} ${blocked}`);
+    return { verdict: "allow", reason: EDIT_TOOLS.has(tool) ? `${tool} inside the repository` : `${tool} only reads inside the repository`, shape: { repoRoot, tool, tokens: [relative] } };
+}
+function evaluateFloor(item, fsx = realFs) {
+    const verdict = judge(item, fsx);
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_floor_judged", message: "judged a cmux Feed item against the floor", meta: { tool: item.toolName, verdict: verdict.verdict, reason: verdict.reason } });
+    return verdict;
+}
+function judge(item, fsx) {
+    if (item.kind !== "permissionRequest")
+        return hard("questions and plan approvals always go to the human");
+    if (item.source !== "claude")
+        return hard(`${item.source} sessions are observe-only`);
+    if (item.toolInputTruncated)
+        return hard("the request was truncated");
+    const tool = item.toolName;
+    if (!tool)
+        return hard("the request names no tool");
+    if (tool.startsWith("mcp__"))
+        return hard("MCP tools always go to the human");
+    if (!item.cwd)
+        return hard("the request has no working directory");
+    const repoRoot = findRepoRoot(item.cwd, fsx);
+    if (!repoRoot)
+        return hard("the working directory is not inside a repository");
+    const cwd = fsx.realpath(item.cwd);
+    const input = parseObject(item.toolInput);
+    if (!input)
+        return hard("the request input is not readable");
+    if (tool === "Bash")
+        return bashVerdict(input.command, repoRoot, cwd, fsx);
+    if (EDIT_TOOLS.has(tool) || READ_TOOLS.has(tool))
+        return pathVerdict(tool, input, repoRoot, cwd, fsx);
+    return hard(`${tool} always goes to the human`);
+}

package/dist/senses/cmux/principles.js

@@ -0,0 +1,72 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SEED_CMUX_PRINCIPLES = exports.CMUX_PRINCIPLES_FILE = void 0;
+exports.readCmuxPrinciples = readCmuxPrinciples;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+/**
+ * Judgment guidance for coding-agent prompts, written by the human. It is guidance only: it never
+ * authorizes a reply. Live replies come from the code floor, the human's exact precedents and a
+ * standing owner grant. The agent reads these when it judges an escalated prompt.
+ *
+ * The bundle may hold its own `cmux-principles.md` (synced, human-authored); otherwise the seed
+ * below applies. The seed is drawn from the operator's standing desk instructions.
+ */
+exports.CMUX_PRINCIPLES_FILE = "cmux-principles.md";
+exports.SEED_CMUX_PRINCIPLES = [
+    "Keep routine work moving: a reversible step inside the session's own repository is the kind of thing the human wants answered without being woken.",
+    "Never act in the human's voice: anything that sends, posts, comments, merges or messages as them goes to them.",
+    "Never cause loss that cannot be undone: deleting files, force-pushing, rewriting shared history or wiping data goes to the human.",
+    "Credentials, sign-in, two-factor codes, payments and accepting terms always belong to the human.",
+    "Stay in scope: actions outside the session's repository, or beyond the task the session was given, go to the human.",
+    "Never widen permissions: no 'always', 'all' or bypass answers, and no edits to agent settings, hooks or CI.",
+    "Production, publishing and shared infrastructure go to the human unless they granted that exact action.",
+    "When unsure, ask: a blocked routine prompt costs the human a minute; a wrong approval can cost far more.",
+];
+function readCmuxPrinciples(agentRoot) {
+    try {
+        const text = fs.readFileSync(path.join(agentRoot, exports.CMUX_PRINCIPLES_FILE), "utf-8");
+        const principles = text.split("\n").map((line) => line.replace(/^\s*(?:[-*]|\d+[.)])\s+/, "").trim()).filter((line) => line && !line.startsWith("#"));
+        if (principles.length > 0)
+            return { source: "bundle", principles };
+    }
+    catch {
+        // No bundle file: use the seed.
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_principles_seeded", message: "using the seed cmux principles", meta: { agentRoot } });
+    return { source: "seed", principles: [...exports.SEED_CMUX_PRINCIPLES] };
+}

package/dist/senses/cmux/sense.js

@@ -47,6 +47,7 @@ const runtime_credentials_1 = require("../../heart/runtime-credentials");
 const pending_1 = require("../../mind/pending");
 const runtime_1 = require("../../nerves/runtime");
 const attention_1 = require("./attention");
+const answer_1 = require("./answer");
 const client_1 = require("./client");
 const RECONNECT_DELAYS_MS = [1_000, 2_000, 5_000, 10_000, 30_000];
 const FEED_POLL_MS = 30_000;
@@ -111,6 +112,7 @@ async function startCmuxSenseApp(options) {
         return () => clearTimeout(timer);
     });
     const statePath = cmuxStatePath(agent);
+    const answers = { agentRoot: (0, identity_1.getAgentRoot)(agent), stateDir: path.dirname(statePath), client, now: nowMs, cmuxVersion: () => state.cmuxVersion };
     const state = (0, attention_1.readCmuxState)(statePath, now());
     state.connected = false;
     let stopped = false;
@@ -142,22 +144,59 @@ async function startCmuxSenseApp(options) {
     const saveSoon = () => {
         cancelSave ??= schedule(save, SAVE_DELAY_MS);
     };
+    /**
+     * One pending item: answered once when the code allows it, otherwise escalated with the reason.
+     * A failure while judging or answering escalates the item with the error; a failure to record the
+     * escalation leaves it unremembered, so the next check retries it. One item never blocks another.
+     */
+    async function handleItem(item) {
+        let reason;
+        let judgment = null;
+        try {
+            judgment = (0, answer_1.judgeFeedItem)(answers, item);
+            if (judgment.reply) {
+                const outcome = await (0, answer_1.answerOnce)(answers, item, judgment);
+                if (outcome === "replied_once" || outcome === "race") {
+                    (0, attention_1.rememberEscalation)(state, item.requestId);
+                    return null;
+                }
+                reason = outcome === "unconfirmed" ? "the sense's reply may or may not have reached cmux, and cmux does not show the request resolved by it" : "the sense's own reply did not go out";
+            }
+            else {
+                reason = judgment.reason;
+            }
+        }
+        catch (error) {
+            reason = `the sense could not judge or answer it: ${error.message}`;
+        }
+        const escalation = (0, attention_1.escalationMessage)(agent, item, (0, attention_1.surfaceForSession)(state, item.workstreamId), reason);
+        try {
+            await escalate(escalation);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.cmux_escalation_error", message: "could not record a cmux Feed request; the next check retries", meta: { agent, error: error.message } });
+            return null;
+        }
+        (0, attention_1.rememberEscalation)(state, item.requestId);
+        (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_escalated", message: "brought a cmux Feed request to the agent", meta: { agent, kind: item.kind, source: item.source } });
+        // The escalation is queued either way; a decision log that cannot take the line is noted, not retried.
+        try {
+            if (judgment)
+                (0, answer_1.recordDecision)(answers, item, judgment, "escalated", reason);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.cmux_decision_log_error", message: "could not log a cmux escalation", meta: { agent, error: error.message } });
+        }
+        return escalation.requestId;
+    }
     async function checkFeed() {
         try {
             const items = (0, attention_1.pendingFeedItems)(await client.call("feed.list", { pending_only: true }));
             const queued = [];
             for (const item of items.filter((entry) => !state.escalated.includes(entry.requestId))) {
-                // One failing item never blocks the others; it stays unremembered, so the next check retries it.
-                try {
-                    const escalation = (0, attention_1.escalationMessage)(agent, item, (0, attention_1.surfaceForSession)(state, item.workstreamId));
-                    await escalate(escalation);
-                    queued.push(escalation.requestId);
-                    (0, attention_1.rememberEscalation)(state, item.requestId);
-                    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_escalated", message: "brought a cmux Feed request to the agent", meta: { agent, kind: item.kind, source: item.source } });
-                }
-                catch (error) {
-                    (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.cmux_escalation_error", message: "could not record a cmux Feed request; the next check retries", meta: { agent, error: error.message } });
-                }
+                const id = await handleItem(item);
+                if (id !== null)
+                    queued.push(id);
             }
             // One wake per check pass: the private turn reads every queued escalation at once.
             if (queued.length > 0)
@@ -205,8 +244,8 @@ async function startCmuxSenseApp(options) {
                     state.connected = true;
                     state.lastError = null;
                     (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_stream_connected", message: "cmux event stream connected", meta: { agent, reset } });
-                    void identify();
-                    requestFeedCheck();
+                    // The version gates answering, so the first Feed check on a connection waits for it.
+                    void identify().then(requestFeedCheck);
                     return;
                 }
                 if (frame.type !== "event")

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.893",
+  "version": "0.1.0-alpha.895",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.893",
+      "version": "0.1.0-alpha.895",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.893",
+  "version": "0.1.0-alpha.895",
   "engines": {
     "node": ">=22"
   },