@ouro.bot/cli 0.1.0-alpha.894 → 0.1.0-alpha.897

package/changelog.json

@@ -1,6 +1,24 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.897",
+      "changes": [
+        "The cmux sense is now Ouro Shepherd (sense 'shepherd', tools shepherd_overview, shepherd_read and shepherd_signal; agent.json key senses.shepherd). Shepherd is agent-agnostic: every time a coding agent in a terminal hands control back, a cheap judge on the agent's own agent lane decides whether it should have, using the same rubric for Claude Code, Codex, Copilot CLI, Agency or any other agent.",
+        "A return is the terminal host's own stop signal: cmux's agent.hook.Stop after a 3-second grace period (dropped when the agent resumed), keyed by cmux's event id, with the agent's last message from cmux's session store (keyed by the agent's own session id; hook events name it '<agent>-<id>'). Terminals no cmux hook speaks for are polled; output that changed and then held still for 8 seconds is one return.",
+        "A premature return is answered visibly: one line typed as '[Ouro for <human>] <reply>' (pasted, then Enter, never starting with / ! or #, with no @, backslash or line break, at most 240 characters) or one menu key, and the status line says so. Shepherd first re-reads the screen and skips a session the human focused in the last minute. A loop guard stops after three answers in a row without a human focus, or ten in an hour, and escalates.",
+        "A stop while the agent's own background work runs (subagents, background shells, watchers) is not a return of control. The judge's new 'working' kind, and cmux's hadPendingBackgroundWorkAtStop (which also earns the stop a 30-second longer wait), mean Shepherd never answers it and never escalates it as a gate: it logs the last message as a progress update and sets the status line to '<agent> waiting on its background work: ...'. Only an update the judge flags as news reaches the Ouro agent, queued with no wake. The session is judged afresh at its next real stop.",
+        "Gates, finished work and loop-guard stops are escalated to the Ouro agent through a pending message and a private wake (trigger 'shepherd'); unclear returns and errors are only logged. Every judgment is one line in state/senses/shepherd/returns.jsonl with latency and input tokens.",
+        "Removed: the cmux Feed polling, the permission-prompt floor, casebook, standing-grant check (inspectStandingActionGrant), cmux_reply_once and cmux_correct, and the Claude-specific decision constants. The cmux machine config record (cmux.socketCapability and friends) is unchanged.",
+        "Review fixes: Shepherd never types into the terminal the human is in, read from cmux's system.tree just before sending (not only from focus events); the loop guard escalates once per trip and stops calling the judge until the human focuses the terminal; with background work reported every verdict is 'working' (a gate becomes news); a repeated background stop with the same last message is not judged again; a quiet terminal judged working or not an agent is checked less often (doubling up to 5 minutes); Shepherd's status is one cmux entry per terminal, cleared when the agent resumes; replies may not contain shell syntax (; $ ` | < > &) or invisible formatting characters."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.895",
+      "changes": [
+        "The vault unlocks once per machine. Each agent's folder under ~/.ouro-cli/bitwarden/ now keeps one disposable bw profile per installed bw version (bw-<version>/), so machines with several bw installs never migrate or share one profile. When a local step fails on an authenticated profile (a null KdfConfig or missing master-password unlock data after a newer bw half-migrated it, or a missing session), Ouro moves the profile aside as data.json.discarded and logs in fresh once with the saved unlock secret, without asking the human. Server steps (login, sync), network errors, rate limits (429), gateway errors (502/504), connection resets, DNS and unreachable-network failures, lock contention and rejected secrets never discard a profile, and those network failures now count as transient. Ouro no longer deletes the saved Keychain/DPAPI/Secret Service/plaintext unlock entry when the vault rejects it: it keeps the entry and writes a private rejection record (mode 0600) in the agent's bw folder that every process honors, so no process retries a rejected secret against the server; `ouro vault unlock` (even with the same secret) or any successful login clears it. A store's terminal login failure is retried after 15 minutes instead of being held until restart. The locked-vault message also names a macOS password reset, which replaces the login keychain, as a cause. The Unraid template and the Sanctuary bundle runtime move to this version."
+      ]
+    },
     {
       "version": "0.1.0-alpha.894",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.894",
+  "runtimeVersion": "0.1.0-alpha.897",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.894</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.897</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/runtime-logging.js

@@ -58,7 +58,7 @@ function defaultLoggingForProcess(processName) {
             sinks: ["terminal", "ndjson"],
         };
     }
-    if (processName === "bluebubbles" || processName === "mail" || processName === "voice" || processName === "a2a" || processName === "cmux") {
+    if (processName === "bluebubbles" || processName === "mail" || processName === "voice" || processName === "a2a" || processName === "shepherd") {
         return {
             level: "warn",
             sinks: ["terminal", "ndjson"],

package/dist/heart/daemon/sense-manager.js

@@ -43,7 +43,7 @@ const runtime_credentials_1 = require("../runtime-credentials");
 const provider_credentials_1 = require("../provider-credentials");
 const sense_truth_1 = require("../sense-truth");
 const machine_identity_1 = require("../machine-identity");
-const cmux_config_1 = require("../cmux-config");
+const shepherd_config_1 = require("../shepherd-config");
 const process_manager_1 = require("./process-manager");
 const config_1 = require("../../a2a/config");
 const DEFAULT_TEAMS_PORT = 3978;
@@ -63,7 +63,7 @@ function defaultSenses() {
         a2a: { ...identity_1.DEFAULT_AGENT_SENSES.a2a },
         telegram: { ...identity_1.DEFAULT_AGENT_SENSES.telegram },
         workbench: { ...identity_1.DEFAULT_AGENT_SENSES.workbench },
-        cmux: { ...identity_1.DEFAULT_AGENT_SENSES.cmux },
+        shepherd: { ...identity_1.DEFAULT_AGENT_SENSES.shepherd },
     };
 }
 function readAgentSenses(agentJsonPath) {
@@ -103,7 +103,7 @@ function readAgentSenses(agentJsonPath) {
         && !Array.isArray(rawMcpServers)
         && Object.prototype.hasOwnProperty.call(rawMcpServers, "ouro_workbench");
     const workbenchHasStaleBundleEntry = workbenchSensePresent || workbenchMcpPresent;
-    for (const sense of ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "workbench", "cmux"]) {
+    for (const sense of ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "workbench", "shepherd"]) {
         const rawSense = rawSenses[sense];
         if (!rawSense || typeof rawSense !== "object" || Array.isArray(rawSense)) {
             continue;
@@ -164,7 +164,7 @@ function runtimeConfigUnavailableDetail(agent, runtimeConfig) {
     return `vault ${itemName} unavailable (${compactRuntimeConfigError(agent, runtimeConfig.error)})`;
 }
 function needsMachineRuntimeConfig(agent, sense) {
-    return sense === "bluebubbles" || sense === "voice" || sense === "a2a" || sense === "cmux" || (agent === "sanctuary" && sense === "telegram");
+    return sense === "bluebubbles" || sense === "voice" || sense === "a2a" || sense === "shepherd" || (agent === "sanctuary" && sense === "telegram");
 }
 function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent), workbenchHasStaleBundleEntry = false) {
     const base = {
@@ -176,7 +176,7 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
         a2a: { configured: false, detail: "not enabled in agent.json" },
         telegram: { configured: false, detail: "not enabled in agent.json" },
         workbench: { configured: false, detail: "not enabled in agent.json" },
-        cmux: { configured: false, detail: "not enabled in agent.json" },
+        shepherd: { configured: false, detail: "not enabled in agent.json" },
     };
     const payload = runtimeConfig.ok ? runtimeConfig.config : {};
     const unavailableDetail = runtimeConfigUnavailableDetail(agent, runtimeConfig);
@@ -345,10 +345,10 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
             detail: publicUrl ? `${publicUrl}${endpointPath}` : `:${port} ${endpointPath}`,
         };
     }
-    if (senses.cmux.enabled) {
-        base.cmux = !machineRuntimeConfig.ok && machineRuntimeConfig.reason !== "missing"
+    if (senses.shepherd.enabled) {
+        base.shepherd = !machineRuntimeConfig.ok && machineRuntimeConfig.reason !== "missing"
             ? { configured: false, detail: runtimeConfigUnavailableDetail(agent, machineRuntimeConfig) }
-            : (0, cmux_config_1.cmuxConfigFacts)(machinePayload);
+            : (0, shepherd_config_1.shepherdConfigFacts)(machinePayload);
     }
     if (workbenchHasStaleBundleEntry || senses.workbench.enabled) {
         base.workbench = {
@@ -377,8 +377,8 @@ function senseRepairHint(agent, sense) {
             ? "Agent-runnable: complete or recover the root authority migration; do not restore a resident Telegram token."
             : `Agent-runnable: store Telegram bot/user/chat coordinates with 'ouro connect telegram --agent ${agent}', then restart with 'ouro up'.`;
     }
-    if (sense === "cmux")
-        return (0, cmux_config_1.cmuxRepairHint)(agent);
+    if (sense === "shepherd")
+        return (0, shepherd_config_1.shepherdRepairHint)(agent);
     /* v8 ignore next -- Workbench is deliberately not daemon-managed, so getSenseInventory never asks the daemon manager for a repair hint @preserve */
     if (sense === "workbench") {
         return `Agent-runnable: install Ouro Workbench.app, then launch the boss through Workbench or run 'ouro acp-serve --agent ${agent} --workbench-mcp'; 'ouro connect workbench --agent ${agent}' only cleans stale bundle entries.`;
@@ -393,7 +393,7 @@ function parseSenseSnapshotName(name) {
     if (parts.length !== 2)
         return null;
     const [agent, sense] = parts;
-    if (sense !== "teams" && sense !== "bluebubbles" && sense !== "mail" && sense !== "voice" && sense !== "a2a" && sense !== "telegram" && sense !== "cmux")
+    if (sense !== "teams" && sense !== "bluebubbles" && sense !== "mail" && sense !== "voice" && sense !== "a2a" && sense !== "telegram" && sense !== "shepherd")
         return null;
     return { agent, sense };
 }
@@ -413,13 +413,13 @@ function managedSenseEntry(sense) {
         return "senses/a2a-entry.js";
     if (sense === "telegram")
         return "senses/telegram-entry.js";
-    if (sense === "cmux")
-        return "senses/cmux-entry.js";
+    if (sense === "shepherd")
+        return "senses/shepherd-entry.js";
     return "senses/mail-entry.js";
 }
 function runtimeCredentialBootstrapFor(agent, sense) {
     const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
-    const usesMachineConfig = sense === "bluebubbles" || sense === "voice" || sense === "a2a" || sense === "telegram" || sense === "cmux";
+    const usesMachineConfig = sense === "bluebubbles" || sense === "voice" || sense === "a2a" || sense === "telegram" || sense === "shepherd";
     const machineId = usesMachineConfig ? currentMachineId() : undefined;
     const machine = usesMachineConfig ? (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent) : null;
     const providerPool = (0, provider_credentials_1.readProviderCredentialPool)(agent);
@@ -590,7 +590,7 @@ class DaemonSenseManager {
             return [agent, { senses, workbenchHasStaleBundleEntry, facts }];
         }));
         const managedSenseAgents = [...this.contexts.entries()].flatMap(([agent, context]) => {
-            return ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "cmux"]
+            return ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "shepherd"]
                 .filter((sense) => context.senses[sense].enabled)
                 .map((sense) => ({
                 name: `${agent}:${sense}`,
@@ -742,7 +742,7 @@ class DaemonSenseManager {
     }
     async refreshEnabledSenseConfigs() {
         const refreshes = [...this.contexts.entries()].map(async ([agent, context]) => {
-            const enabledManagedSenses = ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "cmux"]
+            const enabledManagedSenses = ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "shepherd"]
                 .filter((sense) => context.senses[sense].enabled);
             /* v8 ignore next -- periodic refresh work only exists when a managed background sense is enabled @preserve */
             if (enabledManagedSenses.length === 0)
@@ -916,10 +916,10 @@ class DaemonSenseManager {
                 workbench: {
                     configured: context.facts.workbench.configured,
                 },
-                cmux: {
-                    configured: context.facts.cmux.configured,
-                    optional: context.facts.cmux.optional,
-                    ...(runtime.get(agent)?.cmux ?? {}),
+                shepherd: {
+                    configured: context.facts.shepherd.configured,
+                    optional: context.facts.shepherd.optional,
+                    ...(runtime.get(agent)?.shepherd ?? {}),
                 },
             };
             const inventory = (0, sense_truth_1.getSenseInventory)({ senses: context.senses }, runtimeInfo);

package/dist/heart/identity.js

@@ -145,7 +145,7 @@ exports.DEFAULT_AGENT_SENSES = {
     a2a: { enabled: false },
     telegram: { enabled: false },
     workbench: { enabled: false },
-    cmux: { enabled: false },
+    shepherd: { enabled: false },
 };
 function normalizeSenses(value, configFile) {
     const defaults = {
@@ -157,7 +157,7 @@ function normalizeSenses(value, configFile) {
         a2a: { ...exports.DEFAULT_AGENT_SENSES.a2a },
         telegram: { ...exports.DEFAULT_AGENT_SENSES.telegram },
         workbench: { ...exports.DEFAULT_AGENT_SENSES.workbench },
-        cmux: { ...exports.DEFAULT_AGENT_SENSES.cmux },
+        shepherd: { ...exports.DEFAULT_AGENT_SENSES.shepherd },
     };
     if (value === undefined) {
         return defaults;
@@ -173,7 +173,7 @@ function normalizeSenses(value, configFile) {
         throw new Error(`agent.json at ${configFile} must include senses as an object when present.`);
     }
     const raw = value;
-    const senseNames = ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "workbench", "cmux"];
+    const senseNames = ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "workbench", "shepherd"];
     for (const senseName of senseNames) {
         const rawSense = raw[senseName];
         if (rawSense === undefined) {
@@ -221,7 +221,7 @@ function buildDefaultAgentTemplate(_agentName) {
             a2a: { ...exports.DEFAULT_AGENT_SENSES.a2a },
             telegram: { ...exports.DEFAULT_AGENT_SENSES.telegram },
             workbench: { ...exports.DEFAULT_AGENT_SENSES.workbench },
-            cmux: { ...exports.DEFAULT_AGENT_SENSES.cmux },
+            shepherd: { ...exports.DEFAULT_AGENT_SENSES.shepherd },
         },
         phrases: {
             thinking: [...exports.DEFAULT_AGENT_PHRASES.thinking],

package/dist/heart/private-runtime/policy.js

@@ -150,12 +150,12 @@ async function evaluatePolicy(request, context, deps) {
             reason: "verified daemon external event",
         };
     }
-    if (request.triggerSource === "cmux-feed"
-        && hasNonEmptyOriginRef(originRefs, "cmux-feed")
-        && hasOriginRef(originRefs, "sense", "cmux")) {
+    if (request.triggerSource === "shepherd"
+        && hasNonEmptyOriginRef(originRefs, "shepherd-return")
+        && hasOriginRef(originRefs, "sense", "shepherd")) {
         return {
             result: "allow",
-            reason: "cmux sense escalation",
+            reason: "Shepherd escalation",
         };
     }
     if (request.triggerSource === "operator-cli"

package/dist/heart/sense-truth.js

@@ -12,7 +12,7 @@ const SENSES = [
     { sense: "a2a", label: "A2A", daemonManaged: true },
     { sense: "telegram", label: "Telegram", daemonManaged: true },
     { sense: "workbench", label: "Workbench", daemonManaged: false },
-    { sense: "cmux", label: "cmux", daemonManaged: true },
+    { sense: "shepherd", label: "shepherd", daemonManaged: true },
 ];
 function configuredSenses(senses) {
     const configured = senses ?? {};
@@ -26,7 +26,7 @@ function configuredSenses(senses) {
         a2a: configured.a2a ?? { ...identity_1.DEFAULT_AGENT_SENSES.a2a },
         telegram: configured.telegram ?? { ...identity_1.DEFAULT_AGENT_SENSES.telegram },
         workbench: configured.workbench ?? { ...identity_1.DEFAULT_AGENT_SENSES.workbench },
-        cmux: configured.cmux ?? { ...identity_1.DEFAULT_AGENT_SENSES.cmux },
+        shepherd: configured.shepherd ?? { ...identity_1.DEFAULT_AGENT_SENSES.shepherd },
     };
 }
 function resolveStatus(enabled, daemonManaged, runtimeInfo) {

package/dist/heart/{cmux-config.js → shepherd-config.js}

@@ -33,27 +33,27 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cmuxRepairHint = cmuxRepairHint;
-exports.cmuxConfigFacts = cmuxConfigFacts;
-exports.cmuxSenseStatus = cmuxSenseStatus;
+exports.shepherdRepairHint = shepherdRepairHint;
+exports.shepherdConfigFacts = shepherdConfigFacts;
+exports.shepherdSenseStatus = shepherdSenseStatus;
 exports.defaultCmuxSocketPath = defaultCmuxSocketPath;
-exports.resolveCmuxConnection = resolveCmuxConnection;
+exports.resolveShepherdConnection = resolveShepherdConnection;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const runtime_1 = require("../nerves/runtime");
-function cmuxRepairHint(agent) {
+function shepherdRepairHint(agent) {
     return `human-required: in a cmux terminal run 'ouro vault config set --agent ${agent} --scope machine --key cmux.socketCapability --value "$CMUX_SOCKET_CAPABILITY"' (or set cmux.socketPassword when cmux is in password mode), then 'ouro up'.`;
 }
 function text(record, key) {
     const value = record?.[key];
     return typeof value === "string" ? value.trim() : "";
 }
-function cmuxRecord(machinePayload) {
-    const value = machinePayload.cmux;
+function hostRecord(machinePayload, key) {
+    const value = machinePayload[key];
     return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
 }
-function authFrom(cmux) {
+function cmuxAuth(cmux) {
     const token = text(cmux, "socketCapability");
     if (token)
         return { kind: "capability", token };
@@ -64,18 +64,18 @@ function authFrom(cmux) {
         return { kind: "none" };
     return null;
 }
-function cmuxConfigFacts(machinePayload) {
-    const cmux = cmuxRecord(machinePayload);
-    const auth = authFrom(cmux);
+function shepherdConfigFacts(machinePayload) {
+    const cmux = hostRecord(machinePayload, "cmux");
+    const auth = cmuxAuth(cmux);
     if (!auth)
-        return cmux ? { configured: false, detail: "missing cmux.socketCapability" } : { configured: false, optional: true, detail: "not attached on this machine" };
-    return { configured: true, detail: `socket auth: ${auth.kind === "none" ? "automation mode" : auth.kind}` };
+        return cmux ? { configured: false, detail: "missing cmux.socketCapability" } : { configured: false, optional: true, detail: "no terminal host attached on this machine" };
+    return { configured: true, detail: `cmux socket auth: ${auth.kind === "none" ? "automation mode" : auth.kind}` };
 }
-/** The one-word status the prompt and turn context show for the cmux sense, matching the daemon's sense rows. */
-function cmuxSenseStatus(enabled, machinePayload) {
+/** The one-word status the prompt and turn context show for Shepherd, matching the daemon's sense rows. */
+function shepherdSenseStatus(enabled, machinePayload) {
     if (!enabled)
         return "disabled";
-    const facts = cmuxConfigFacts(machinePayload);
+    const facts = shepherdConfigFacts(machinePayload);
     if (facts.configured)
         return "ready";
     return facts.optional ? "not_attached" : "needs_config";
@@ -87,16 +87,16 @@ function defaultCmuxSocketPath(homeDir = os.homedir(), uid = process.getuid?.()
     const unscoped = path.join(dir, "cmux.sock");
     return !exists(scoped) && exists(unscoped) ? unscoped : scoped;
 }
-function resolveCmuxConnection(agent, machinePayload, defaultSocketPath = defaultCmuxSocketPath) {
-    const cmux = cmuxRecord(machinePayload);
-    const auth = authFrom(cmux);
+function resolveShepherdConnection(agent, machinePayload, defaultSocketPath = defaultCmuxSocketPath) {
+    const cmux = hostRecord(machinePayload, "cmux");
+    const auth = cmuxAuth(cmux);
     (0, runtime_1.emitNervesEvent)({
         component: "senses",
-        event: "senses.cmux_connection_resolved",
-        message: "resolved cmux socket connection settings",
-        meta: { agent, auth: auth?.kind ?? "missing" },
+        event: "senses.shepherd_connection_resolved",
+        message: "resolved Shepherd terminal host connection settings",
+        meta: { agent, host: auth ? "cmux" : "none", auth: auth?.kind ?? "missing" },
     });
     if (!auth)
-        return { ok: false, error: `cmux socket auth is not configured on this machine; ${cmuxRepairHint(agent)}` };
-    return { ok: true, connection: { socketPath: text(cmux, "socketPath") || defaultSocketPath(), auth } };
+        return { ok: false, error: `no terminal host is attached on this machine; ${shepherdRepairHint(agent)}` };
+    return { ok: true, connection: { host: "cmux", socketPath: text(cmux, "socketPath") || defaultSocketPath(), auth } };
 }

package/dist/heart/steward-policy.js

@@ -38,7 +38,6 @@ exports.assertNotReplayIdentity = assertNotReplayIdentity;
 exports.updateStewardPolicy = updateStewardPolicy;
 exports.readRoutineActionReceipts = readRoutineActionReceipts;
 exports.inspectRoutineActionGrant = inspectRoutineActionGrant;
-exports.inspectStandingActionGrant = inspectStandingActionGrant;
 exports.consumeRoutineActionGrant = consumeRoutineActionGrant;
 exports.withStewardPolicyLease = withStewardPolicyLease;
 exports.withRoutineActionAttempt = withRoutineActionAttempt;
@@ -525,31 +524,6 @@ function inspectRoutineActionGrant(agentRoot, input) {
         return { allowed: false, reason: error instanceof Error ? error.message : "routine action policy is unavailable" };
     }
 }
-function inspectStandingActionGrant(agentRoot, input) {
-    try {
-        const { policy, rows } = readPolicyState(agentRoot);
-        const now = input.now ?? new Date().toISOString();
-        const grant = policy.routineActionGrants[input.key];
-        if (!grant)
-            return { allowed: false, reason: "standing grant is missing" };
-        if (grant.provenance !== "stated")
-            return { allowed: false, reason: "standing grant must be owner-stated" };
-        if (!appliedEntry(rows, ["grant_routine_action"], input.key, grant))
-            return { allowed: false, reason: "standing grant has no applied owner authorization" };
-        if (grant.action !== input.action)
-            return { allowed: false, reason: "action does not match the standing grant" };
-        if (!grant.targets.includes(input.target) || grant.exclusions.includes(input.target))
-            return { allowed: false, reason: "target is not covered by the standing grant" };
-        if (grant.expiresAt && Date.parse(grant.expiresAt) <= Date.parse(now))
-            return { allowed: false, reason: "standing grant expired" };
-        if (input.usesInWindow(grant.windowMs) >= grant.maxCount)
-            return { allowed: false, reason: "standing grant count cap reached" };
-        return { allowed: true, grantVersion: grant.version, maxCount: grant.maxCount, windowMs: grant.windowMs };
-    }
-    catch (error) {
-        return { allowed: false, reason: error instanceof Error ? error.message : "steward policy is unavailable" };
-    }
-}
 function consumeRoutineActionGrant(agentRoot, input) {
     if (!text(input.authorizationReceiptId))
         throw new Error("routine action requires a current authorization receipt");

package/dist/heart/turn-context.js

@@ -63,7 +63,7 @@ const provider_visibility_1 = require("./provider-visibility");
 const mail_import_discovery_1 = require("./mail-import-discovery");
 const flight_recorder_1 = require("../arc/flight-recorder");
 const context_loss_sentinel_1 = require("./context-loss-sentinel");
-const cmux_config_1 = require("./cmux-config");
+const shepherd_config_1 = require("./shepherd-config");
 // ── Helpers ─────────────────────────────────────────────────────────
 const DAEMON_SOCKET_PATH = "/tmp/ouroboros-daemon.sock";
 function isLiveCodingSessionStatus(status) {
@@ -168,7 +168,7 @@ function readSenseStatusLines() {
         a2a: configuredSenses.a2a ?? { enabled: false },
         telegram: configuredSenses.telegram ?? { enabled: false },
         workbench: configuredSenses.workbench ?? { enabled: false },
-        cmux: configuredSenses.cmux ?? { enabled: false },
+        shepherd: configuredSenses.shepherd ?? { enabled: false },
     };
     const payload = (0, config_1.loadConfig)();
     const agentName = (0, identity_1.getAgentName)();
@@ -223,7 +223,7 @@ function readSenseStatusLines() {
                 && hasTextField(runtimePayload, "telegramAuthorizedUserId")
                 && hasTextField(runtimePayload, "telegramAuthorizedChatId"),
         workbench: false,
-        cmux: (0, cmux_config_1.cmuxSenseStatus)(true, machinePayload) === "ready",
+        shepherd: (0, shepherd_config_1.shepherdSenseStatus)(true, machinePayload) === "ready",
     };
     const rows = [
         { label: "CLI", status: "interactive" },
@@ -252,8 +252,8 @@ function readSenseStatusLines() {
             status: !senses.telegram.enabled ? "disabled" : configured.telegram ? "ready" : "needs_config",
         },
         {
-            label: "cmux",
-            status: (0, cmux_config_1.cmuxSenseStatus)(senses.cmux.enabled, machinePayload),
+            label: "shepherd",
+            status: (0, shepherd_config_1.shepherdSenseStatus)(senses.shepherd.enabled, machinePayload),
         },
         {
             label: "Workbench",

package/dist/mind/prompt.js

@@ -86,7 +86,7 @@ const daemon_health_1 = require("../heart/daemon/daemon-health");
 const scrutiny_1 = require("./scrutiny");
 const pulse_1 = require("../heart/daemon/pulse");
 const provider_visibility_1 = require("../heart/provider-visibility");
-const cmux_config_1 = require("../heart/cmux-config");
+const shepherd_config_1 = require("../heart/shepherd-config");
 const store_1 = require("../trips/store");
 const orientation_frame_1 = require("../heart/orientation-frame");
 const flight_recorder_1 = require("../arc/flight-recorder");
@@ -479,7 +479,7 @@ function localSenseStatusLines() {
         a2a: configuredSenses.a2a ?? { enabled: false },
         telegram: configuredSenses.telegram ?? { enabled: false },
         workbench: configuredSenses.workbench ?? { enabled: false },
-        cmux: configuredSenses.cmux ?? { enabled: false },
+        shepherd: configuredSenses.shepherd ?? { enabled: false },
     };
     const payload = (0, config_1.loadConfig)();
     const runtimeConfig = (0, runtime_credentials_1.readRuntimeCredentialConfig)((0, identity_1.getAgentName)());
@@ -508,7 +508,7 @@ function localSenseStatusLines() {
             && hasTextField(runtimePayload, "telegramAuthorizedUserId")
             && hasTextField(runtimePayload, "telegramAuthorizedChatId"),
         workbench: false,
-        cmux: (0, cmux_config_1.cmuxSenseStatus)(true, machinePayload) === "ready",
+        shepherd: (0, shepherd_config_1.shepherdSenseStatus)(true, machinePayload) === "ready",
     };
     const rows = [
         { label: "CLI", status: "interactive" },
@@ -537,8 +537,8 @@ function localSenseStatusLines() {
             status: !senses.telegram.enabled ? "disabled" : configured.telegram ? "ready" : "needs_config",
         },
         {
-            label: "cmux",
-            status: (0, cmux_config_1.cmuxSenseStatus)(senses.cmux.enabled, machinePayload),
+            label: "shepherd",
+            status: (0, shepherd_config_1.shepherdSenseStatus)(senses.shepherd.enabled, machinePayload),
         },
         {
             label: "Workbench",