@ouro.bot/cli 0.1.0-alpha.900 → 0.1.0-alpha.903

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.903",
+      "changes": [
+        "Shepherd on Herdr now watches a pane opened after it started. Herdr sends a new pane's `pane_created` event with the pane under `data.pane` and no top-level `pane_id`, so the Herdr host ignored it and never subscribed to the new pane's agent status; it now resubscribes on every `pane_created`, and the test fake sends that event in Herdr's real shape. The Unraid template points at the 0.1.0-alpha.903 Butler image."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.901",
+      "changes": [
+        "Bundle sync never commits a file over 50 MiB, so one oversized file can no longer block every later push (GitHub rejects files over 100 MiB). Sync leaves such a file uncommitted in the working tree, keeps the last committed version of a tracked file, holds back the deletion of the old path when a big file is renamed, and records skipped files in state/sync-skipped-files.json. The rebase retry uses --autostash, so an uncommitted oversized file no longer blocks it. A failed sync now stays visible until it is fixed: state/pending-sync.json is written for every failure (including a failed git status), carries the date the failures began and how many attempts have failed in a row, and is no longer deleted after one turn. When nothing changed, sync clears the record if the bundle matches its upstream (or has no remote) and otherwise pushes the commits an earlier failure left behind. `ouro status` shows a failing bundle as 'failing' with that date and count and lists skipped files, and the daemon health checks report both as a bundle-sync warning for sync-enabled bundles. Sync commits with -q and gives git a 256 MiB output buffer and a 120-second timeout for add, commit, push and pull, and the context-loss sentinel's git status gets the same buffer, because a bundle with about 30,000 changed files overflowed the 1 MiB default (ENOBUFS) and took 17 seconds to stage."
+      ]
+    },
     {
       "version": "0.1.0-alpha.900",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.900",
+  "runtimeVersion": "0.1.0-alpha.903",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.900</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.903</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/context-loss-sentinel.js

@@ -42,6 +42,7 @@ exports.formatContextLossSentinelJson = formatContextLossSentinelJson;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
+const sync_1 = require("./sync");
 const crypto_1 = require("crypto");
 const flight_recorder_1 = require("../arc/flight-recorder");
 const runtime_1 = require("../nerves/runtime");
@@ -528,6 +529,7 @@ function defaultGitStatus(agentRoot) {
             encoding: "utf-8",
             stdio: ["ignore", "pipe", "pipe"],
             timeout: CONTEXT_LOSS_SENTINEL_GIT_STATUS_TIMEOUT_MS,
+            maxBuffer: sync_1.SYNC_GIT_MAX_BUFFER_BYTES,
         });
         return { ok: true, porcelain };
     }

package/dist/heart/daemon/agent-discovery.js

@@ -49,6 +49,7 @@ const child_process_1 = require("child_process");
 const identity_1 = require("../identity");
 const machine_identity_1 = require("../machine-identity");
 const runtime_1 = require("../../nerves/runtime");
+const sync_health_1 = require("../sync-health");
 /**
  * True when the value is the string `"library"`. Library bundles are
  * content-only resources — never run as agents, never appear in sync surfaces.
@@ -347,6 +348,11 @@ function listBundleSyncRows(options = {}) {
                 catch {
                     // No remote configured or git missing — leave remoteUrl undefined.
                 }
+                const health = (0, sync_health_1.readBundleSyncHealth)(bundleRoot, { readFileSync });
+                if (health.failure)
+                    row.failure = health.failure;
+                if (health.skippedFiles.length > 0)
+                    row.skippedFiles = health.skippedFiles;
             }
         }
         rows.push(row);

package/dist/heart/daemon/cli-render.js

@@ -57,6 +57,7 @@ const identity_1 = require("../identity");
 const daemon_tombstone_1 = require("./daemon-tombstone");
 const daemon_health_1 = require("./daemon-health");
 const agent_discovery_1 = require("./agent-discovery");
+const sync_health_1 = require("../sync-health");
 // ── Field extractors ──
 function stringField(value) {
     return typeof value === "string" ? value : null;
@@ -267,6 +268,12 @@ function parseStatusPayload(data) {
         const gitInitialized = booleanField(row.gitInitialized);
         if (gitInitialized !== null)
             parsed.gitInitialized = gitInitialized;
+        const failure = (0, sync_health_1.parseBundleSyncFailure)(row.failure);
+        if (failure)
+            parsed.failure = failure;
+        const skippedFiles = (0, sync_health_1.parseBundleSyncSkippedFiles)(row.skippedFiles);
+        if (skippedFiles.length > 0)
+            parsed.skippedFiles = skippedFiles;
         return parsed;
     });
     const parsedAgents = (agents ?? []).map((entry) => {
@@ -584,6 +591,11 @@ function formatDaemonStatusOutput(response, fallback) {
                 stateText = "error   ".padEnd(10);
                 detail = "not a git repo — run `git init` to enable sync";
             }
+            else if (row.failure) {
+                dot = red("●");
+                stateText = "failing ".padEnd(10);
+                detail = (0, sync_health_1.describeSyncFailure)(row.failure);
+            }
             else if (row.remoteUrl !== undefined) {
                 dot = green("●");
                 stateText = "enabled ".padEnd(10);
@@ -595,6 +607,9 @@ function formatDaemonStatusOutput(response, fallback) {
                 detail = "local only";
             }
             lines.push(`    ${name} ${dot} ${stateText}  ${dim(detail)}`);
+            if (row.enabled && row.skippedFiles && row.skippedFiles.length > 0) {
+                lines.push(`    ${" ".repeat(agentNameWidth)} ${yellow("●")} ${"warn".padEnd(10)}  ${dim((0, sync_health_1.describeSkippedFiles)(row.skippedFiles))}`);
+            }
         }
         lines.push("");
     }

package/dist/heart/daemon/daemon-entry.js

@@ -83,6 +83,7 @@ const sanctuary_acceptance_marker_1 = require("./sanctuary-acceptance-marker");
 const sanctuary_scheduler_liveness_1 = require("./sanctuary-scheduler-liveness");
 const sanctuary_scheduler_origin_1 = require("./sanctuary-scheduler-origin");
 const telegram_1 = require("../../senses/telegram");
+const sync_health_1 = require("../sync-health");
 function parseSocketPath(argv) {
     const socketIndex = argv.indexOf("--socket");
     if (socketIndex >= 0) {
@@ -343,6 +344,7 @@ const healthMonitor = new health_monitor_1.HealthMonitor({
         }
         return [...sentinels, homes.health];
     },
+    bundleSyncChecker: () => [(0, sync_health_1.checkBundleSyncHealth)((0, agent_discovery_1.listBundleSyncRows)({ bundlesRoot: (0, identity_1.getAgentBundlesRoot)() }).filter((row) => managedAgents.includes(row.agent)))],
     senseProbeProvider: () => [
         ...senseManager.listHealthProbes(),
         ...managedAgents.map((agent) => (0, mcp_canary_1.createMcpStatusCanaryProbe)({

package/dist/heart/daemon/health-monitor.js

@@ -8,6 +8,7 @@ class HealthMonitor {
     alertSink;
     diskUsagePercent;
     sentinelChecker;
+    bundleSyncChecker;
     onCriticalAgent;
     onCriticalSense;
     senseProbes;
@@ -20,6 +21,7 @@ class HealthMonitor {
         this.alertSink = options.alertSink ?? (() => undefined);
         this.diskUsagePercent = options.diskUsagePercent ?? (() => 0);
         this.sentinelChecker = options.sentinelChecker ?? (() => []);
+        this.bundleSyncChecker = options.bundleSyncChecker ?? (() => []);
         this.onCriticalAgent = options.onCriticalAgent ?? (() => undefined);
         this.onCriticalSense = options.onCriticalSense ?? (() => undefined);
         this.senseProbes = options.senseProbes ?? [];
@@ -148,6 +150,16 @@ class HealthMonitor {
                 message: `disk usage healthy (${diskPercent}%)`,
             });
         }
+        try {
+            results.push(...this.bundleSyncChecker());
+        }
+        catch (error) {
+            results.push({
+                name: "bundle-sync",
+                status: "warn",
+                message: `bundle sync check failed: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
         const senseProbes = [...this.senseProbes];
         try {
             senseProbes.push(...this.senseProbeProvider());

package/dist/heart/sync-health.js

@@ -0,0 +1,152 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseBundleSyncFailure = parseBundleSyncFailure;
+exports.parseBundleSyncSkippedFiles = parseBundleSyncSkippedFiles;
+exports.readBundleSyncHealth = readBundleSyncHealth;
+exports.summarizeSyncError = summarizeSyncError;
+exports.formatMegabytes = formatMegabytes;
+exports.describeSyncFailure = describeSyncFailure;
+exports.describeSkippedFiles = describeSkippedFiles;
+exports.checkBundleSyncHealth = checkBundleSyncHealth;
+/**
+ * Reads the two bundle sync records that post-turn sync leaves on disk and
+ * turns them into one view for `ouro status` and the daemon health check:
+ *
+ *   - `state/pending-sync.json`: the last sync failed and nothing has
+ *     succeeded since (written and cleared by `postTurnPush`).
+ *   - `state/sync-skipped-files.json`: files sync left uncommitted because
+ *     they are over `SYNC_FILE_SIZE_LIMIT_BYTES`.
+ *
+ * Reading never throws: an unreadable or malformed record reads as absent.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../nerves/runtime");
+function readJson(filePath, readFile) {
+    try {
+        return JSON.parse(readFile(filePath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+/**
+ * Accepts both the on-disk `pending-sync.json` shape (`failedAt`) and the
+ * `BundleSyncFailure` shape the daemon sends in status (`lastFailedAt`).
+ */
+function parseBundleSyncFailure(value) {
+    const record = asRecord(value);
+    if (!record || typeof record.error !== "string")
+        return null;
+    const lastFailedAt = typeof record.failedAt === "string"
+        ? record.failedAt
+        : typeof record.lastFailedAt === "string" ? record.lastFailedAt : "unknown";
+    return {
+        error: record.error,
+        classification: typeof record.classification === "string" ? record.classification : "unknown",
+        firstFailedAt: typeof record.firstFailedAt === "string" ? record.firstFailedAt : lastFailedAt,
+        lastFailedAt,
+        consecutiveFailures: typeof record.consecutiveFailures === "number" && record.consecutiveFailures > 0
+            ? record.consecutiveFailures
+            : 1,
+    };
+}
+/** Accepts the `sync-skipped-files.json` record or a bare array of files. */
+function parseBundleSyncSkippedFiles(value) {
+    const files = Array.isArray(value) ? value : asRecord(value)?.files;
+    if (!Array.isArray(files))
+        return [];
+    return files.flatMap((entry) => {
+        const file = asRecord(entry);
+        if (!file || typeof file.path !== "string" || typeof file.bytes !== "number")
+            return [];
+        return [{ path: file.path, bytes: file.bytes }];
+    });
+}
+function readBundleSyncHealth(agentRoot, deps = {}) {
+    const readFile = deps.readFileSync ?? ((p, encoding) => fs.readFileSync(p, encoding));
+    return {
+        failure: parseBundleSyncFailure(readJson(path.join(agentRoot, "state", "pending-sync.json"), readFile)),
+        skippedFiles: parseBundleSyncSkippedFiles(readJson(path.join(agentRoot, "state", "sync-skipped-files.json"), readFile)),
+    };
+}
+/** First line of a git error, capped so one status line stays readable. */
+function summarizeSyncError(error) {
+    const firstLine = error.split("\n").map((line) => line.trim()).find((line) => line.length > 0) ?? "unknown";
+    return firstLine.length > 160 ? `${firstLine.slice(0, 157)}...` : firstLine;
+}
+function formatMegabytes(bytes) {
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;
+}
+function describeSyncFailure(failure) {
+    return `sync failing since ${failure.firstFailedAt} (${failure.consecutiveFailures} attempt(s)): ${summarizeSyncError(failure.error)}`;
+}
+function describeSkippedFiles(files) {
+    const listed = files.slice(0, 3).map((file) => `${file.path} (${formatMegabytes(file.bytes)})`).join(", ");
+    const more = files.length > 3 ? `, and ${files.length - 3} more` : "";
+    return `${files.length} file(s) too large to sync left uncommitted: ${listed}${more}`;
+}
+/**
+ * Daemon health check over the managed agents' bundle sync rows. Bundles with
+ * sync disabled are ignored. Sync trouble is a warning, never critical: the
+ * agent still runs, but its bundle is not being backed up, which must stay
+ * visible until someone fixes it.
+ */
+function checkBundleSyncHealth(rows) {
+    const problems = [];
+    for (const row of rows) {
+        if (!row.enabled)
+            continue;
+        if (row.failure)
+            problems.push(`${row.agent}: ${describeSyncFailure(row.failure)}`);
+        if (row.skippedFiles && row.skippedFiles.length > 0)
+            problems.push(`${row.agent}: ${describeSkippedFiles(row.skippedFiles)}`);
+    }
+    if (problems.length === 0) {
+        return { name: "bundle-sync", status: "ok", message: "bundle sync healthy" };
+    }
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        component: "heart",
+        event: "heart.bundle_sync_unhealthy",
+        message: "bundle sync health check found problems",
+        meta: { problems },
+    });
+    return { name: "bundle-sync", status: "warn", message: problems.join("; ") };
+}

package/dist/heart/sync.js

@@ -33,7 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.STALE_INDEX_LOCK_MS = void 0;
+exports.STALE_INDEX_LOCK_MS = exports.SYNC_GIT_TIMEOUT_MS = exports.SYNC_GIT_MAX_BUFFER_BYTES = exports.SYNC_FILE_SIZE_LIMIT_BYTES = void 0;
+exports.pendingSyncPath = pendingSyncPath;
+exports.skippedSyncFilesPath = skippedSyncFilesPath;
+exports.clearPendingSync = clearPendingSync;
 exports.preTurnPull = preTurnPull;
 exports.postTurnPush = postTurnPush;
 exports.preTurnPullAsync = preTurnPullAsync;
@@ -41,16 +44,172 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../nerves/runtime");
+const sync_health_1 = require("./sync-health");
+/**
+ * Sync never commits a file larger than this. GitHub rejects any push that
+ * contains a file over 100 MiB and warns above 50 MiB; one such file in an
+ * unpushed commit blocks every later push from the bundle. The guard leaves
+ * the file in the working tree, uncommitted, and records it.
+ */
+exports.SYNC_FILE_SIZE_LIMIT_BYTES = 50 * 1024 * 1024;
+/**
+ * Output buffer for git commands whose output grows with the number of
+ * changed files. Node's 1 MiB default made `git status` fail with ENOBUFS
+ * once a bundle held about 30,000 changed files, which stopped sync.
+ */
+exports.SYNC_GIT_MAX_BUFFER_BYTES = 256 * 1024 * 1024;
+/**
+ * Timeout for sync's add, commit, push and pull. `git add -A` took 17 s on a
+ * bundle with 30,000 changed files, past the old 10 s limit.
+ */
+exports.SYNC_GIT_TIMEOUT_MS = 120_000;
+function pendingSyncPath(agentRoot) {
+    return path.join(agentRoot, "state", "pending-sync.json");
+}
+function skippedSyncFilesPath(agentRoot) {
+    return path.join(agentRoot, "state", "sync-skipped-files.json");
+}
+function readPreviousFailure(agentRoot) {
+    try {
+        return (0, sync_health_1.parseBundleSyncFailure)(JSON.parse(fs.readFileSync(pendingSyncPath(agentRoot), "utf-8")));
+    }
+    catch {
+        return null;
+    }
+}
 function writePendingSync(agentRoot, error, classification, conflictFiles) {
-    const pendingSyncPath = path.join(agentRoot, "state", "pending-sync.json");
+    const previous = readPreviousFailure(agentRoot);
+    const failedAt = new Date().toISOString();
+    const previousFirst = previous && previous.firstFailedAt !== "unknown" ? previous.firstFailedAt : null;
     fs.mkdirSync(path.join(agentRoot, "state"), { recursive: true });
     const record = {
         error,
-        failedAt: new Date().toISOString(),
+        failedAt,
         classification,
         conflictFiles,
+        firstFailedAt: previousFirst ?? failedAt,
+        consecutiveFailures: (previous?.consecutiveFailures ?? 0) + 1,
     };
-    fs.writeFileSync(pendingSyncPath, JSON.stringify(record, null, 2), "utf-8");
+    fs.writeFileSync(pendingSyncPath(agentRoot), JSON.stringify(record, null, 2), "utf-8");
+}
+function recordPendingSync(agentRoot, error, classification, conflictFiles) {
+    try {
+        writePendingSync(agentRoot, error, classification, conflictFiles);
+    }
+    catch {
+        // Best effort: the caller's nerves event still records the failure.
+    }
+}
+/**
+ * Remove `state/pending-sync.json` after a sync that reached the remote (or
+ * committed, for a local-only bundle). The record otherwise stays, so the
+ * start-of-turn packet, `ouro status` and the daemon health check keep
+ * reporting the failure until it is fixed.
+ */
+function clearPendingSync(agentRoot) {
+    try {
+        fs.rmSync(pendingSyncPath(agentRoot), { force: true });
+    }
+    catch {
+        // Best effort: a stale record is reported again and cleared next time.
+    }
+}
+function writeSkippedSyncFiles(agentRoot, files) {
+    try {
+        if (files.length === 0) {
+            fs.rmSync(skippedSyncFilesPath(agentRoot), { force: true });
+            return;
+        }
+        fs.mkdirSync(path.join(agentRoot, "state"), { recursive: true });
+        const record = {
+            updatedAt: new Date().toISOString(),
+            limitBytes: exports.SYNC_FILE_SIZE_LIMIT_BYTES,
+            files,
+        };
+        fs.writeFileSync(skippedSyncFilesPath(agentRoot), JSON.stringify(record, null, 2), "utf-8");
+    }
+    catch {
+        // Best effort: the nerves event emitted by the caller names the files.
+    }
+}
+/** Parse `git diff --cached --name-status -z` output. */
+function parseStagedChanges(output) {
+    const tokens = output.split("\0").filter((entry) => entry.length > 0);
+    const changes = [];
+    for (let index = 0; index < tokens.length;) {
+        const status = tokens[index];
+        if (status.startsWith("R") || status.startsWith("C")) {
+            changes.push({ status, fromPath: tokens[index + 1], path: tokens[index + 2] });
+            index += 3;
+        }
+        else {
+            changes.push({ status, path: tokens[index + 1] });
+            index += 2;
+        }
+    }
+    return changes;
+}
+/**
+ * Unstage every staged file larger than `SYNC_FILE_SIZE_LIMIT_BYTES`. The
+ * file stays in the working tree and the previous committed version, if any,
+ * stays in the index, so nothing is deleted on other machines. For a rename,
+ * the deletion of the old path is unstaged too; otherwise the remote would
+ * lose the old path while never receiving the new one.
+ */
+function unstageOversizedFiles(agentRoot) {
+    const changes = parseStagedChanges((0, child_process_1.execFileSync)("git", ["diff", "--cached", "--name-status", "-M", "-z"], {
+        cwd: agentRoot,
+        stdio: "pipe",
+        timeout: exports.SYNC_GIT_TIMEOUT_MS,
+        maxBuffer: exports.SYNC_GIT_MAX_BUFFER_BYTES,
+    }).toString());
+    const oversized = [];
+    const unstage = [];
+    for (const change of changes) {
+        if (change.status.startsWith("D"))
+            continue;
+        let bytes;
+        try {
+            bytes = fs.lstatSync(path.join(agentRoot, change.path)).size;
+        }
+        catch {
+            continue;
+        }
+        if (bytes <= exports.SYNC_FILE_SIZE_LIMIT_BYTES)
+            continue;
+        oversized.push({ path: change.path, bytes });
+        unstage.push(change.path);
+        if (change.status.startsWith("R") && change.fromPath)
+            unstage.push(change.fromPath);
+    }
+    if (oversized.length === 0)
+        return oversized;
+    (0, child_process_1.execFileSync)("git", ["--literal-pathspecs", "reset", "-q", "--", ...unstage], {
+        cwd: agentRoot,
+        stdio: "pipe",
+        timeout: exports.SYNC_GIT_TIMEOUT_MS,
+    });
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        component: "heart",
+        event: "heart.sync_oversized_files_skipped",
+        message: "post-turn push: left files over the sync size limit uncommitted",
+        meta: { agentRoot, limitBytes: exports.SYNC_FILE_SIZE_LIMIT_BYTES, files: oversized },
+    });
+    return oversized;
+}
+function hasStagedChanges(agentRoot) {
+    try {
+        (0, child_process_1.execFileSync)("git", ["diff", "--cached", "--quiet"], {
+            cwd: agentRoot,
+            stdio: "pipe",
+            timeout: exports.SYNC_GIT_TIMEOUT_MS,
+        });
+        return false;
+    }
+    catch {
+        return true;
+    }
 }
 function collectRebaseConflictFiles(agentRoot) {
     try {
@@ -58,6 +217,7 @@ function collectRebaseConflictFiles(agentRoot) {
             cwd: agentRoot,
             stdio: "pipe",
             timeout: 5000,
+            maxBuffer: exports.SYNC_GIT_MAX_BUFFER_BYTES,
         }).toString();
         const files = [];
         for (const line of output.split("\n")) {
@@ -248,11 +408,13 @@ function postTurnPush(agentRoot, config) {
         statusOutput = (0, child_process_1.execFileSync)("git", ["status", "--porcelain"], {
             cwd: agentRoot,
             stdio: "pipe",
-            timeout: 10000,
+            timeout: exports.SYNC_GIT_TIMEOUT_MS,
+            maxBuffer: exports.SYNC_GIT_MAX_BUFFER_BYTES,
         }).toString().trim();
     }
     catch (err) {
         const error = err instanceof Error ? err.message : String(err);
+        recordPendingSync(agentRoot, error, "unknown", []);
         (0, runtime_1.emitNervesEvent)({
             component: "heart",
             event: "heart.sync_push_error",
@@ -262,13 +424,9 @@ function postTurnPush(agentRoot, config) {
         return { ok: false, error };
     }
     if (statusOutput.length === 0) {
-        (0, runtime_1.emitNervesEvent)({
-            component: "heart",
-            event: "heart.sync_push_end",
-            message: "post-turn push: no changes to sync",
-            meta: { agentRoot },
-        });
-        return { ok: true };
+        // Nothing to commit, so nothing is skipped for size any more.
+        writeSkippedSyncFiles(agentRoot, []);
+        return syncCleanTree(agentRoot, config);
     }
     const changedCount = statusOutput.split("\n").length;
     clearStaleIndexLock(agentRoot);
@@ -276,116 +434,179 @@ function postTurnPush(agentRoot, config) {
         (0, child_process_1.execFileSync)("git", ["add", "-A"], {
             cwd: agentRoot,
             stdio: "pipe",
-            timeout: 10000,
+            timeout: exports.SYNC_GIT_TIMEOUT_MS,
+            maxBuffer: exports.SYNC_GIT_MAX_BUFFER_BYTES,
         });
-        (0, child_process_1.execFileSync)("git", ["commit", "-m", "sync: post-turn update"], {
+        const skippedFiles = unstageOversizedFiles(agentRoot);
+        writeSkippedSyncFiles(agentRoot, skippedFiles);
+        if (skippedFiles.length > 0 && !hasStagedChanges(agentRoot)) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "heart",
+                event: "heart.sync_push_end",
+                message: "post-turn push: only oversized files changed, nothing committed",
+                meta: { agentRoot, changedCount, skippedCount: skippedFiles.length },
+            });
+            return syncCleanTree(agentRoot, config);
+        }
+        // -q: without it git prints a create/delete line per file, which overran
+        // the output buffer on a 30,000-file commit after the commit had landed.
+        (0, child_process_1.execFileSync)("git", ["commit", "-q", "-m", "sync: post-turn update"], {
             cwd: agentRoot,
             stdio: "pipe",
-            timeout: 10000,
+            timeout: exports.SYNC_GIT_TIMEOUT_MS,
+            maxBuffer: exports.SYNC_GIT_MAX_BUFFER_BYTES,
         });
-        // Check if a remote exists
-        const remoteOutput = (0, child_process_1.execFileSync)("git", ["remote"], {
-            cwd: agentRoot,
-            stdio: "pipe",
-            timeout: 5000,
-        }).toString().trim();
-        if (remoteOutput.length === 0) {
+        if (!hasRemote(agentRoot)) {
             (0, runtime_1.emitNervesEvent)({
                 component: "heart",
                 event: "heart.sync_push_end",
                 message: "post-turn push: committed locally, no remote configured",
                 meta: { agentRoot, changedCount },
             });
+            clearPendingSync(agentRoot);
             return { ok: true };
         }
+        return pushWithRebaseRetry(agentRoot, config, changedCount);
+    }
+    catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        // Record it so the start-of-turn packet surfaces the failure; otherwise a
+        // failing local commit is visible only in nerves logs.
+        recordPendingSync(agentRoot, error, "unknown", []);
+        (0, runtime_1.emitNervesEvent)({
+            component: "heart",
+            event: "heart.sync_push_error",
+            message: "post-turn push failed",
+            meta: { agentRoot, error },
+        });
+        return { ok: false, error };
+    }
+}
+function hasRemote(agentRoot) {
+    return (0, child_process_1.execFileSync)("git", ["remote"], {
+        cwd: agentRoot,
+        stdio: "pipe",
+        timeout: 5000,
+    }).toString().trim().length > 0;
+}
+/**
+ * Nothing new to commit. A failure record must not outlive the problem, and
+ * commits left behind by an earlier failed push still need to reach the
+ * remote: with no remote, or nothing ahead of the upstream, the record is
+ * cleared; with unpushed commits, the push is retried.
+ */
+function syncCleanTree(agentRoot, config) {
+    try {
+        if (!hasRemote(agentRoot)) {
+            clearPendingSync(agentRoot);
+        }
+        else {
+            const ahead = Number.parseInt((0, child_process_1.execFileSync)("git", ["rev-list", "--count", "@{upstream}..HEAD"], {
+                cwd: agentRoot,
+                stdio: "pipe",
+                timeout: 5000,
+            }).toString().trim(), 10);
+            if (ahead > 0)
+                return pushWithRebaseRetry(agentRoot, config, 0);
+            if (ahead === 0)
+                clearPendingSync(agentRoot);
+        }
+    }
+    catch (err) {
+        // No upstream tracked (or git failed): nothing to compare against, so
+        // leave any failure record as it is rather than guess.
+        (0, runtime_1.emitNervesEvent)({
+            component: "heart",
+            event: "heart.sync_upstream_unknown",
+            message: "post-turn push: could not compare with upstream",
+            meta: { agentRoot, error: err instanceof Error ? err.message : /* v8 ignore next -- defensive non-Error catch @preserve */ String(err) },
+        });
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "heart",
+        event: "heart.sync_push_end",
+        message: "post-turn push: no changes to sync",
+        meta: { agentRoot },
+    });
+    return { ok: true };
+}
+function pushWithRebaseRetry(agentRoot, config, changedCount) {
+    try {
+        (0, child_process_1.execFileSync)("git", ["push", config.remote], {
+            cwd: agentRoot,
+            stdio: "pipe",
+            timeout: exports.SYNC_GIT_TIMEOUT_MS,
+            maxBuffer: exports.SYNC_GIT_MAX_BUFFER_BYTES,
+        });
+    }
+    catch {
+        // Push rejected -- try pull-rebase-push. --autostash: an oversized file
+        // the size guard left uncommitted is an unstaged change, and a plain
+        // rebase refuses to start while one exists.
+        let rebaseError = null;
         try {
-            (0, child_process_1.execFileSync)("git", ["push", config.remote], {
+            (0, child_process_1.execFileSync)("git", ["pull", "--rebase", "--autostash", config.remote], {
                 cwd: agentRoot,
                 stdio: "pipe",
-                timeout: 30000,
+                timeout: exports.SYNC_GIT_TIMEOUT_MS,
+                maxBuffer: exports.SYNC_GIT_MAX_BUFFER_BYTES,
             });
         }
-        catch {
-            // Push rejected -- try pull-rebase-push
-            let rebaseError = null;
+        catch (err) {
+            rebaseError = err instanceof Error ? err.message : String(err);
+        }
+        if (rebaseError === null) {
             try {
-                (0, child_process_1.execFileSync)("git", ["pull", "--rebase", config.remote], {
+                (0, child_process_1.execFileSync)("git", ["push", config.remote], {
                     cwd: agentRoot,
                     stdio: "pipe",
-                    timeout: 30000,
+                    timeout: exports.SYNC_GIT_TIMEOUT_MS,
+                    maxBuffer: exports.SYNC_GIT_MAX_BUFFER_BYTES,
                 });
+                // rebase + retry push both succeeded — fall through to success
+                (0, runtime_1.emitNervesEvent)({
+                    component: "heart",
+                    event: "heart.sync_push_end",
+                    message: "post-turn push complete after rebase retry",
+                    meta: { agentRoot, changedCount },
+                });
+                clearPendingSync(agentRoot);
+                return { ok: true };
             }
-            catch (err) {
-                rebaseError = err instanceof Error ? err.message : String(err);
-            }
-            if (rebaseError === null) {
-                try {
-                    (0, child_process_1.execFileSync)("git", ["push", config.remote], {
-                        cwd: agentRoot,
-                        stdio: "pipe",
-                        timeout: 30000,
-                    });
-                    // rebase + retry push both succeeded — fall through to success
-                    (0, runtime_1.emitNervesEvent)({
-                        component: "heart",
-                        event: "heart.sync_push_end",
-                        message: "post-turn push complete after rebase retry",
-                        meta: { agentRoot, changedCount },
-                    });
-                    return { ok: true };
-                }
-                catch (retryErr) {
-                    // Second push rejected — remote advanced again during rebase
-                    const retryError = retryErr instanceof Error ? retryErr.message : /* v8 ignore next -- defensive non-Error catch @preserve */ String(retryErr);
-                    writePendingSync(agentRoot, retryError, "push_rejected", []);
-                    (0, runtime_1.emitNervesEvent)({
-                        component: "heart",
-                        event: "heart.sync_push_error",
-                        message: "post-turn push failed after retry: push_rejected",
-                        meta: { agentRoot, error: retryError, classification: "push_rejected" },
-                    });
-                    return { ok: false, error: retryError };
-                }
+            catch (retryErr) {
+                // Second push rejected — remote advanced again during rebase
+                const retryError = retryErr instanceof Error ? retryErr.message : /* v8 ignore next -- defensive non-Error catch @preserve */ String(retryErr);
+                recordPendingSync(agentRoot, retryError, "push_rejected", []);
+                (0, runtime_1.emitNervesEvent)({
+                    component: "heart",
+                    event: "heart.sync_push_error",
+                    message: "post-turn push failed after retry: push_rejected",
+                    meta: { agentRoot, error: retryError, classification: "push_rejected" },
+                });
+                return { ok: false, error: retryError };
             }
-            // Rebase failed — detect conflict files via git status. Preserve
-            // the original rebase error message so callers see the real cause.
-            const conflictFiles = collectRebaseConflictFiles(agentRoot);
-            const classification = conflictFiles.length > 0 ? "pull_rebase_conflict" : "unknown";
-            writePendingSync(agentRoot, rebaseError, classification, conflictFiles);
-            (0, runtime_1.emitNervesEvent)({
-                component: "heart",
-                event: "heart.sync_push_error",
-                message: `post-turn push failed: ${classification}`,
-                meta: { agentRoot, error: rebaseError, classification, conflictFiles },
-            });
-            return { ok: false, error: rebaseError };
-        }
-        (0, runtime_1.emitNervesEvent)({
-            component: "heart",
-            event: "heart.sync_push_end",
-            message: "post-turn push complete",
-            meta: { agentRoot, changedCount },
-        });
-        return { ok: true };
-    }
-    catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
-        // Record it so the start-of-turn packet surfaces the failure; otherwise a
-        // failing local commit is visible only in nerves logs.
-        try {
-            writePendingSync(agentRoot, error, "unknown", []);
-        }
-        catch {
-            // Best effort: the nerves event below still records the failure.
         }
+        // Rebase failed — detect conflict files via git status. Preserve
+        // the original rebase error message so callers see the real cause.
+        const conflictFiles = collectRebaseConflictFiles(agentRoot);
+        const classification = conflictFiles.length > 0 ? "pull_rebase_conflict" : "unknown";
+        recordPendingSync(agentRoot, rebaseError, classification, conflictFiles);
         (0, runtime_1.emitNervesEvent)({
             component: "heart",
             event: "heart.sync_push_error",
-            message: "post-turn push failed",
-            meta: { agentRoot, error },
+            message: `post-turn push failed: ${classification}`,
+            meta: { agentRoot, error: rebaseError, classification, conflictFiles },
         });
-        return { ok: false, error };
+        return { ok: false, error: rebaseError };
     }
+    (0, runtime_1.emitNervesEvent)({
+        component: "heart",
+        event: "heart.sync_push_end",
+        message: "post-turn push complete",
+        meta: { agentRoot, changedCount },
+    });
+    clearPendingSync(agentRoot);
+    return { ok: true };
 }
 /**
  * Layer 2 — async, signal-aware sibling of `preTurnPull`.

package/dist/repertoire/tools-bundle.js

@@ -79,6 +79,7 @@ const path = __importStar(require("path"));
 const runtime_1 = require("../nerves/runtime");
 const identity_1 = require("../heart/identity");
 const bundle_state_1 = require("../heart/bundle-state");
+const sync_1 = require("../heart/sync");
 const bundle_templates_1 = require("./bundle-templates");
 function gitExec(bundleRoot, args, timeoutMs = 10000) {
     try {
@@ -778,6 +779,7 @@ function makePushHandler(deps = {}) {
         const push = gitExec(bundleRoot, ["push", remote, "HEAD"], 30000);
         /* v8 ignore start -- push success branch requires a reachable remote, not practical to cover in unit tests; failure branch covered by network-failure test @preserve */
         if (push.code === 0) {
+            (0, sync_1.clearPendingSync)(bundleRoot);
             return finish(true, { remote, firstPush: isFirstPush });
         }
         /* v8 ignore stop */

package/dist/senses/pipeline.js

@@ -63,6 +63,7 @@ const start_of_turn_packet_1 = require("../heart/start-of-turn-packet");
 const bundle_state_1 = require("../heart/bundle-state");
 const sync_1 = require("../heart/sync");
 const agent_discovery_1 = require("../heart/daemon/agent-discovery");
+const sync_health_1 = require("../heart/sync-health");
 const config_1 = require("../heart/config");
 const session_events_1 = require("../heart/session-events");
 const session_activity_1 = require("../heart/session-activity");
@@ -754,14 +755,16 @@ async function handleInboundTurnExclusive(input) {
             if (!pullResult.ok) {
                 syncFailure = pullResult.error;
             }
-            // Check for pending-sync from a prior failed push
+            // Check for pending-sync from a prior failed push. The record stays
+            // until a sync succeeds, so every turn sees a failure that persists.
             if (!syncFailure) {
                 const pendingSyncPath = path.join((0, identity_1.getAgentRoot)(), "state", "pending-sync.json");
                 try {
                     if (fs.existsSync(pendingSyncPath)) {
-                        const pendingSync = JSON.parse(fs.readFileSync(pendingSyncPath, "utf-8"));
-                        syncFailure = `prior sync push failed: ${pendingSync.error ?? "unknown"}`;
-                        fs.unlinkSync(pendingSyncPath);
+                        const failure = (0, sync_health_1.parseBundleSyncFailure)(JSON.parse(fs.readFileSync(pendingSyncPath, "utf-8")));
+                        syncFailure = failure
+                            ? `bundle ${(0, sync_health_1.describeSyncFailure)(failure)}`
+                            : "bundle sync failed earlier; state/pending-sync.json is unreadable";
                     }
                 }
                 catch {

package/dist/senses/shepherd/herdr.js

@@ -218,17 +218,21 @@ function createHerdrHost(connection, options = {}) {
                     stream?.close();
                     return;
                 }
+                // Agent-status subscriptions name each pane, so a new or closed pane needs a new subscription. Herdr sends a new
+                // pane as `data.pane` with no top-level `pane_id`; the fresh pane list after resubscribing picks it up.
+                if (name === "pane_created") {
+                    refresh = true;
+                    stream?.close();
+                    return;
+                }
                 const paneId = str(data.pane_id);
                 if (!paneId)
                     return;
                 if (name === "pane_focused")
                     return handlers.focused(paneId);
-                if (name === "pane_created" || name === "pane_closed") {
-                    if (name === "pane_closed") {
-                        cancelPending(paneId);
-                        status.delete(paneId);
-                    }
-                    // Agent-status subscriptions name each pane, so a new or closed pane needs a new subscription.
+                if (name === "pane_closed") {
+                    cancelPending(paneId);
+                    status.delete(paneId);
                     refresh = true;
                     stream?.close();
                     return;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.900",
+  "version": "0.1.0-alpha.903",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.900",
+      "version": "0.1.0-alpha.903",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.900",
+  "version": "0.1.0-alpha.903",
   "engines": {
     "node": ">=22"
   },