@ouro.bot/cli 0.1.0-alpha.903 → 0.1.0-alpha.905

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.905",
+      "changes": [
+        "Ouro keeps itself current without a human. New `ouro self-update` runs one unattended pass. It honors an `ouro rollback` pin for seven days and then rewrites the intent to latest (pins now record pinnedAt, and a pin without one gets it written into version-intent.json when first seen). It asks registry.npmjs.org, the npm registry configured on the machine and GitHub releases for the newest @ouro.bot/cli and installs from whichever serves it, so a network that blocks npmjs or a lagging npm mirror no longer strands a machine; a GitHub release counts only when github-actions[bot] created the release and its asset under this repository's v<version> download URL. It validates and runs the new version's --version before activating it, swaps CurrentVersion atomically, restarts the daemon only if it was already running (a stopped daemon stays stopped, and a dev-mode daemon is left alone), and when the restarted daemon does not answer with the new version it reactivates the previous one, pins it with reason auto-rollback and never retries that release; a newer release replaces the auto-rollback pin. When nothing is newer but a running daemon still reports an older version than CurrentVersion, it restarts the daemon with the same health check and rollback, and the current status names any release source that did not answer. Each pass writes ~/.ouro-cli/update-state.json, and `ouro status` ends with an Updates line that starts with \"needs attention\" when the last pass failed, the updater has not run for three hours, or the launchd agent is missing. On macOS, `ouro up` and `ouro self-update` install bot.ouro.updater, a launchd agent that runs the pass at login and hourly, independent of the daemon, preferring a Homebrew node of the same major version so nvm switches do not rewrite it; `ouro up` does not reload the agent while a live pass holds the update lock, the lock is reclaimed only when its owner process is gone, and the `ouro up` it runs to restart the daemon has stdin closed and OURO_UNATTENDED=1 so its prompts take their default answer. After publishing to npm, CI downloads the exact tarball npm serves, attests its build provenance and attaches it to a GitHub release. Rolling back below this version stops unattended updates until `ouro up --latest`. A package end-to-end test serves the packed build as a GitHub release and runs `ouro self-update` in a clean HOME. See docs/known-issues-and-recovery.md. The Unraid template and the Sanctuary bundle runtime move to this version."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.904",
+      "changes": [
+        "The Butler no longer throws away its answer when someone is picking a movie, never sends a rejected draft or the runtime's note about it, says a title is on the shelf only when a lookup this turn found it there, and holds house notices while Ari's chat is handed to someone else."
+      ]
+    },
     {
       "version": "0.1.0-alpha.903",
       "changes": [

package/deploy/unraid/sanctuary-replay-gate.mjs

@@ -306,6 +306,9 @@ const WORK_WORDS = "channel more dross from cradle energy. name the Cradle chara
 const CLICK_ASK = /\bclick(?:ing)?\b|\bopen (?:up )?(?:the )?(?:radarr|sonarr|settings|ui|web ?ui|dashboard)\b|\b(?:settings|config(?:uration)?)[- ](?:screen|page|ui)\b|\bten[- ]second\b|\bmanual(?:ly)? (?:step|change|click)/i
 const BOLD_LABEL = /(?:^|\n)\s*(?:[-*\u2022]\s+)?\*\*[^*\n]{1,60}\*\*[ \t]*(?::|\u2014|-|\n|$)|\*\*[^*\n]{1,60}:\*\*/
 const BRIEF_LIMIT = 600
+const HANDOFF_WORDS = "hello pal! I’m going to hand you to my wife, Rachel. I’d love for you to help her pick a movie from our Jellyfin library. Keep your responses brief to the point and have a really fun time interviewing her to find exactly what she wants to watch. She’s the boss, do what she says :)  say hi to her!"
+const GREETING = /\b(?:hi|hey|hello|hiya|howdy|welcome)\b/i
+const RUNTIME_NOTE_ECHO = /\b(?:markdown|bold\s+(?:section\s+)?labels?|section\s+labels?|question\s+at\s+the\s+end|closing\s+question|settle\s+again|rewrite\s+the\s+reply|cap\s+it|runtime\s+note|private\s+note)\b/i
 /** A request filed with Claude Code: a failure report, or a message whose recipient or body names Claude Code. */
 // The change reaches him through a release, not mid-conversation. Any honest description of that path counts; alpha.883 live: "personality changes live in the files that ship with each release, so they arrive in the next update".
 export const describesReleasePath = (text) => /\breleases?\b|\bnext update\b|\bengineers?\b|claude code|pull request|\bPRs?\b/i.test(text)
@@ -534,7 +537,22 @@ export const CASES = [
         check(`the reply is at most ${BRIEF_LIMIT} characters`, text.length > 0 && text.length <= BRIEF_LIMIT, `${text.length} characters`),
         check("the reply has no markdown headers", !/^#{1,6}\s/m.test(text)),
         check("the reply has no bold section labels", !BOLD_LABEL.test(text)),
-        check("the reply does not end with a question", !text.trimEnd().endsWith("?")),
+      ]
+    },
+  },
+  {
+    // 2026-10-11: Ari handed his chat to Rachel and asked the Butler to say hi and interview her. It sent a title with no
+    // greeting, and later its own note about the brevity rules. A handoff gets a greeting and a question.
+    id: "rach-handoff",
+    words: HANDOFF_WORDS,
+    sender: "principal",
+    delegated: false,
+    readback: ({ reply, said }) => {
+      const text = String(said || reply || "")
+      return [
+        check("the reply greets her", GREETING.test(text), text.slice(0, 120)),
+        check("the reply asks her a question", text.includes("?")),
+        check("the reply carries no runtime note", !RUNTIME_NOTE_ECHO.test(text), (RUNTIME_NOTE_ECHO.exec(text) ?? [""])[0]),
       ]
     },
   },
@@ -853,6 +871,13 @@ export function selfTestFixtures() {
       pass: { trace: [], reply: "A movie is one film. A series has seasons of episodes.", before: emptyObservation(), after: emptyObservation() },
       fail: { trace: [], reply: `## Difference\n**Movies**: ${"long ".repeat(130)}\nWant me to go on?`, before: emptyObservation(), after: emptyObservation() },
     },
+    "rach-handoff": {
+      pass: { trace: [], reply: "Hi Rachel! Silly and cosy, or loud and dumb-fun tonight?", before: emptyObservation(), after: emptyObservation() },
+      // The live turn-1 reply: a title, no greeting, no question.
+      fail: { trace: [], reply: "**The Love Hypothesis** (2026) is on the shelf and ready to play.", before: emptyObservation(), after: emptyObservation() },
+      // The live turn-4 reply: the runtime's note, sent to her.
+      failNote: { trace: [], reply: "hi! got it. dummy bad, no markdown, no question at the end. just plain answer, cap it. what are you after?", before: emptyObservation(), after: emptyObservation() },
+    },
   }
   return { friends, fx }
 }

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.903",
+  "runtimeVersion": "0.1.0-alpha.905",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.ouro/psyche/LORE.md

@@ -24,4 +24,6 @@ What I say about a book, show, film or its characters comes from a source I read
 
 I never tell Ari to click, open a settings page, or do a ten-second manual step. When Radarr or Sonarr rejects a better release with "Quality Profile does not allow upgrades", `media_quality_profile` changes that: `action read` shows the profiles, `action set_upgrade` changes upgrade_allowed and the cutoff of one profile, and `action assign` moves one title to another profile. Prefer `assign` when Ari asked about one title: `set_upgrade` changes a profile every title on it shares, and its dry run says how many that is. Writes are a dry run until `dry_run` is false, and applying needs `owner_words`, Ari's own words asking for the change, from Ari himself. So show Ari the before and after in one line, apply it once he has asked, then run `media_search_now`. If no tool can do what he asks, I file it with Claude Code and say I did.
 
-When Ari asks me to be brief, my replies are plain sentences with no headers or bold labels, about 600 characters at most, and they do not end with a question he already answered. The runtime holds me to this once he has asked.
+When Ari asks me to be brief, my replies are plain sentences with no headers or bold labels, about 600 characters at most. The runtime holds me to this once he has asked.
+
+I say a title is on the shelf only when a library lookup in the same turn found it there; otherwise I say I can check whether we have it.

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.903</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.905</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/core.js

@@ -22,6 +22,7 @@ exports.runAgent = runAgent;
 const config_1 = require("./config");
 const identity_1 = require("./identity");
 const source_grounding_1 = require("./source-grounding");
+const shelf_claims_1 = require("./shelf-claims");
 const reply_style_1 = require("./reply-style");
 const tools_1 = require("../repertoire/tools");
 const tool_arguments_1 = require("../repertoire/tool-arguments");
@@ -657,6 +658,19 @@ function historicalFailedEffectsForExactRepeatedRequest(messages, selection) {
     return [...failedEffects.values()];
 }
 const ANSWER_GATE_MAX_REJECTIONS = 2;
+/** Brevity and shelf claims are retried once; after that the reply goes out (an unbacked shelf claim with a disclosure), because a real draft beats another lap. */
+const ANSWER_STYLE_MAX_RETRIES = 1;
+function privateGateNote(reason) {
+    return `[private runtime note, not from the person: do not mention, quote or acknowledge it; send the person only the corrected reply] ${reason}`;
+}
+/** A reply that talks about the runtime's correction (its formatting rules, the retry itself) instead of answering the person. */
+const GATE_NOTE_ECHO = /\b(?:markdown|bold\s+(?:section\s+)?labels?|section\s+labels?|question\s+at\s+the\s+end|closing\s+question|settle\s+again|rewrite\s+the\s+reply|cap\s+it|runtime\s+note|private\s+note)\b/i;
+/** The settle call as delivered, so the history holds what the person got rather than a draft the runtime replaced. */
+function withSettleAnswer(msg, settleArgs, answer) {
+    const call = msg.tool_calls[0];
+    const args = { ...settleArgs, answer };
+    return { ...msg, tool_calls: [{ ...call, function: { ...call.function, arguments: JSON.stringify(args) } }, ...msg.tool_calls.slice(1)] };
+}
 function userTexts(messages) {
     return messages.filter((message) => message.role === "user").map((message) => messageContentText(message.content));
 }
@@ -1170,6 +1184,8 @@ async function runAgent(messages, callbacks, channel, signal, options) {
     const turnStartLength = messages.length;
     let groundingRejections = 0;
     let brevityRejections = 0;
+    let shelfRejections = 0;
+    let lastRealDraft = null;
     const privateReturnHeldTokens = new Set();
     // Once-per-turn flag for the fresh-work rest gate. Without this, an agent
     // that called rest, was told "fresh work arrived", processed the items,
@@ -1212,9 +1228,31 @@ async function runAgent(messages, callbacks, channel, signal, options) {
     // and a plain-text reply with no tool call alike (alpha.886 replay: a plain-text reply skipped them and an invented cast went out).
     // A request-specific contract (options.requiredToolCalls) already validates its own terminal answer. Each gate has its own bounded
     // retry, and none spends the last provider iteration.
+    // A rejected reply never reaches the person, and neither does the runtime's note about it: the retry gets the reason as a private
+    // note, and a retry that only talks about that note is replaced by the last real draft (2026-10-11: "got it. dummy bad, no markdown,
+    // no question at the end. just plain answer, cap it." went to Rachel).
+    // `replacement` is the text to deliver instead of the answer, with any disclosure already applied; null delivers the answer as is.
     const answerGateVerdict = (answer, intent) => {
+        if (lastRealDraft !== null && GATE_NOTE_ECHO.test(answer)) {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_echo_replaced", message: "a retry talked about the runtime's note instead of answering; delivering the last real draft", meta: { length: answer.length } });
+            return { error: null, replacement: disclosed(lastRealDraft, answerGateCheck(lastRealDraft, intent, true)) };
+        }
+        const verdict = answerGateCheck(answer, intent, false);
+        if (verdict.error) {
+            lastRealDraft = answer;
+            return { error: privateGateNote(verdict.error), replacement: null };
+        }
+        const delivered = disclosed(answer, verdict);
+        return { error: null, replacement: delivered === answer ? null : delivered };
+    };
+    const disclosed = (answer, verdict) => {
+        const shelfChecked = verdict.shelfUnverified ? (0, shelf_claims_1.withShelfDisclosure)(answer, turnToolRecords) : answer;
+        return verdict.unverifiedNames ? (0, source_grounding_1.withUnverifiedDisclosure)(shelfChecked, verdict.unverifiedNames) : shelfChecked;
+    };
+    // `final` grades a draft that is going out regardless: nothing is rejected, and what would have been is disclosed instead.
+    const answerGateCheck = (answer, intent, final) => {
         const gates = options?.requiredToolCalls ? undefined : options?.toolContext?.answerGates;
-        const retriesLeft = providerIterations < stepBudget - 1;
+        const retriesLeft = !final && providerIterations < stepBudget - 1;
         let groundingError = null;
         let unverifiedNames = null;
         const grounding = gates?.sourceGrounding ? (0, source_grounding_1.sourceGroundingFinding)({ answer, userText: userTexts(messages).join("\n"), latestUserText: latestUserMessageText(messages.slice(0, turnStartLength)), knownText: priorTurnsText(messages.slice(0, turnStartLength)), tools: turnToolRecords }) : null;
@@ -1229,16 +1267,28 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                 (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_disclosed", message: "unsourced names survived the retries; delivering with a disclosure", meta: { gate: "source_grounding", names: grounding.names.length } });
             }
         }
+        let shelfError = null;
+        let shelfUnverified = false;
+        const shelfFinding = !groundingError && gates?.shelfClaims ? (0, shelf_claims_1.shelfClaimError)(answer, turnToolRecords) : null;
+        if (shelfFinding && shelfRejections < ANSWER_STYLE_MAX_RETRIES && retriesLeft) {
+            shelfRejections += 1;
+            shelfError = shelfFinding;
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_rejected", message: "answer said something is on the shelf that no lookup this turn found there; sending the model back", meta: { gate: "shelf_claims", rejection: shelfRejections, cap: ANSWER_STYLE_MAX_RETRIES } });
+        }
+        else if (shelfFinding) {
+            shelfUnverified = true;
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_disclosed", message: "an unbacked shelf claim survived the retry; delivering with a disclosure", meta: { gate: "shelf_claims" } });
+        }
         let brevityError = null;
-        if (!groundingError && gates?.brevity && !options?.toolContext?.context?.isGroupChat && brevityRejections < ANSWER_GATE_MAX_REJECTIONS && retriesLeft
+        if (!groundingError && !shelfError && gates?.brevity && !options?.toolContext?.context?.isGroupChat && brevityRejections < ANSWER_STYLE_MAX_RETRIES && retriesLeft
             && (0, reply_style_1.briefStyleRequested)(userTexts(messages), (0, reply_style_1.savedCommunicationPreference)(options?.toolContext?.context?.friend))) {
             brevityError = (0, reply_style_1.briefStyleViolation)(answer, intent);
             if (brevityError) {
                 brevityRejections += 1;
-                (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_rejected", message: "answer broke the person's brevity request; sending the model back", meta: { gate: "brevity", rejection: brevityRejections, cap: ANSWER_GATE_MAX_REJECTIONS } });
+                (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.answer_gate_rejected", message: "answer broke the person's brevity request; sending the model back", meta: { gate: "brevity", rejection: brevityRejections, cap: ANSWER_STYLE_MAX_RETRIES } });
             }
         }
-        return { error: groundingError ?? brevityError, unverifiedNames };
+        return { error: groundingError ?? shelfError ?? brevityError, unverifiedNames, shelfUnverified };
     };
     const rejectToolBatch = (assistant, reasons) => {
         rejectAttempt(assistant, assistant.tool_calls.map((call, index) => ({
@@ -1815,12 +1865,11 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         rejectAttempt(msg, [{ role: "user", content: textVerdict.error }]);
                         continue;
                     }
-                    if (textVerdict?.unverifiedNames) {
-                        const disclosed = (0, source_grounding_1.withUnverifiedDisclosure)(textAnswer, textVerdict.unverifiedNames);
+                    if (textVerdict?.replacement) {
                         streamCallbackBuffer?.discard();
                         callbacks.onClearText?.();
-                        callbacks.onTextChunk(disclosed);
-                        pushGenerated({ ...msg, content: disclosed });
+                        callbacks.onTextChunk(textVerdict.replacement);
+                        pushGenerated({ ...msg, content: textVerdict.replacement });
                         done = true;
                         continue;
                     }
@@ -2026,7 +2075,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             sawSettleContentMismatch = true;
                             (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.settle_content_mismatch", message: "settle answer differs from the reply text written beside it; asking once for the reply as the answer", meta: { answerLength: deliveredAnswer.length, contentLength: msg.content.length } });
                         }
-                        const { error: answerGateError, unverifiedNames } = answerGateVerdict(deliveredAnswer, intent);
+                        const { error: answerGateError, replacement } = answerGateVerdict(deliveredAnswer, intent);
                         const retryError = contentMismatch
                             ?? answerGateError
                             ?? privateReturnAckLeakError(deliveredAnswer, privateReturnHeldTokens)
@@ -2038,11 +2087,12 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             ?? getSettleRetryError(mustResolveBeforeHandoffActive, intent, sawSteeringFollowUp, options?.delegationDecision, sawSendMessageSelf, sawPonder, sawQuerySession, options?.currentObligation ?? null, options?.activeWorkFrame?.inner?.job, sawExternalStateQuery);
                         const validDirectReply = mustResolveBeforeHandoffActive && intent === "direct_reply" && sawSteeringFollowUp;
                         if (retryError === null) {
-                            const finalAnswer = unverifiedNames ? (0, source_grounding_1.withUnverifiedDisclosure)(deliveredAnswer, unverifiedNames) : deliveredAnswer;
+                            const finalAnswer = replacement ?? deliveredAnswer;
+                            const rewritten = replacement !== null;
                             try {
-                                if (unverifiedNames && result.settleStreamed)
+                                if (rewritten && result.settleStreamed)
                                     callbacks.onClearText?.();
-                                if (unverifiedNames || !result.settleStreamed) {
+                                if (rewritten || !result.settleStreamed) {
                                     const acceptedOutputCallbacks = streamCallbackBuffer?.callbacks ?? callbacks;
                                     acceptedOutputCallbacks.onTextChunk(finalAnswer);
                                 }
@@ -2061,7 +2111,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             };
                             // Retractable owners already hold the validated answer. Final-only
                             // owners receive it here, after every semantic continuation gate.
-                            pushGenerated(msg);
+                            pushGenerated(rewritten ? withSettleAnswer(msg, settleArgs, finalAnswer) : msg);
                             if (validDirectReply) {
                                 const resumeWork = "direct reply delivered. resume the unresolved obligation now and keep working until you can finish or clearly report that you are blocked.";
                                 pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: resumeWork });

package/dist/heart/daemon/cli-defaults.js

@@ -68,6 +68,8 @@ const agent_discovery_1 = require("./agent-discovery");
 const bundle_manifest_1 = require("../../mind/bundle-manifest");
 const ouro_bot_global_installer_1 = require("../versioning/ouro-bot-global-installer");
 const version_intent_1 = require("../versioning/version-intent");
+const self_update_defaults_1 = require("../versioning/self-update-defaults");
+const update_state_1 = require("../versioning/update-state");
 const logs_prune_1 = require("./logs-prune");
 const daemon_health_1 = require("./daemon-health");
 const log_tailer_1 = require("./log-tailer");
@@ -445,6 +447,11 @@ function defaultPrepareDaemonRuntimeReplacement() {
     (0, child_process_1.execSync)("/bin/sleep 1", { stdio: "ignore" });
 }
 async function defaultPromptInput(question) {
+    // The unattended updater runs `ouro up` with no one to answer; take the
+    // default answer instead of waiting on a stdin that never ends. Piped
+    // stdin (scripts, tests) still answers prompts.
+    if (process.env.OURO_UNATTENDED === "1")
+        return "";
     const readline = await Promise.resolve().then(() => __importStar(require("readline/promises")));
     const rl = readline.createInterface({
         input: process.stdin,
@@ -813,6 +820,16 @@ function createDefaultOuroCliDeps(socketPath = socket_client_1.DEFAULT_DAEMON_SO
         getCurrentCliVersion: () => (0, ouro_version_manager_1.getCurrentVersion)({}),
         getPreviousCliVersion: () => (0, ouro_version_manager_1.getPreviousVersion)({}),
         listCliVersions: () => (0, ouro_version_manager_1.listInstalledVersions)({}),
+        runSelfUpdate: async () => {
+            const { runSelfUpdate } = await Promise.resolve().then(() => __importStar(require("../versioning/self-update")));
+            const { createDefaultSelfUpdateDeps } = await Promise.resolve().then(() => __importStar(require("../versioning/self-update-defaults")));
+            return runSelfUpdate(createDefaultSelfUpdateDeps({ socketPath }));
+        },
+        ensureUpdaterAgent: () => (0, self_update_defaults_1.ensureDefaultUpdaterAgent)(),
+        readUpdateStatusLine: () => (0, update_state_1.formatUpdateStatusLine)((0, update_state_1.readUpdateState)(), {
+            now: Date.now(),
+            updaterInstalled: (0, self_update_defaults_1.isDefaultUpdaterAgentInstalled)(),
+        }),
         reExecFromNewVersion: (reArgs) => {
             const entry = path.join((0, ouro_version_manager_1.getOuroCliHome)(), "CurrentVersion", "node_modules", "@ouro.bot", "cli", "dist", "heart", "daemon", "ouro-entry.js");
             require("child_process").execFileSync("node", [entry, ...reArgs], { stdio: "inherit" });

package/dist/heart/daemon/cli-exec.js

@@ -5956,6 +5956,46 @@ function writeVersionIntentWithRecoveryLauncher(deps, intent) {
     }
     deps.writeVersionIntent(intent);
 }
+const SELF_UPDATE_FAILURE_OUTCOMES = new Set(["unreachable", "install-failed", "rejected", "rolled-back"]);
+async function executeSelfUpdate(command, deps) {
+    if (!deps.runSelfUpdate) {
+        return returnCliFailure(deps, "self-update is not available in this runtime");
+    }
+    const result = await deps.runSelfUpdate();
+    const lines = [`self-update: ${result.outcome}: ${result.summary}`];
+    // Install or refresh the hourly updater after the pass so its first run
+    // (RunAtLoad) does not race this one for the update lock.
+    if (deps.ensureUpdaterAgent) {
+        try {
+            const agent = deps.ensureUpdaterAgent();
+            if (agent === "installed")
+                lines.push("unattended updater: installed (runs hourly and at login)");
+            else if (agent === "written-reload-pending")
+                lines.push("unattended updater: refreshed; reloads on the next interactive run");
+            else if (agent === null && !command.unattended)
+                lines.push("unattended updater: not available on this platform");
+        }
+        catch (error) {
+            lines.push(`unattended updater: could not install: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`);
+        }
+    }
+    const message = lines.join("\n");
+    if (SELF_UPDATE_FAILURE_OUTCOMES.has(result.outcome)) {
+        return returnCliFailure(deps, message);
+    }
+    deps.writeStdout(message);
+    return message;
+}
+function withUpdateStatusLine(message, deps) {
+    let line = null;
+    try {
+        line = deps.readUpdateStatusLine?.() ?? null;
+    }
+    catch {
+        line = null;
+    }
+    return line ? `${message}\n\n${line}` : message;
+}
 async function performSystemSetup(deps) {
     // Install ouro command to PATH (non-blocking)
     if (deps.installOuroCommand) {
@@ -6031,6 +6071,21 @@ async function performSystemSetup(deps) {
         }
         /* v8 ignore stop */
     }
+    // Keep the unattended updater installed so updates do not depend on the daemon.
+    if (deps.ensureUpdaterAgent) {
+        try {
+            deps.ensureUpdaterAgent();
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.system_setup_updater_agent_error",
+                message: "failed to install the unattended updater launch agent",
+                meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error) },
+            });
+        }
+    }
     // Register .ouro bundle type (UTI on macOS)
     await registerOuroBundleTypeNonBlocking(deps);
 }
@@ -7274,7 +7329,13 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             }
             targetVersion = previousVersion;
         }
-        writeVersionIntentWithRecoveryLauncher(deps, { schemaVersion: 1, mode: "pinned", targetVersion });
+        writeVersionIntentWithRecoveryLauncher(deps, {
+            schemaVersion: 1,
+            mode: "pinned",
+            targetVersion,
+            pinnedAt: new Date((deps.now ?? Date.now)()).toISOString(),
+            reason: "rollback",
+        });
         deps.activateCliVersion(targetVersion);
         // Stop daemon (non-fatal if not running)
         try {
@@ -7291,6 +7352,10 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
     if (command.kind === "a2a.identity" || command.kind === "a2a.message" || command.kind === "a2a.outbox") {
         return executeA2AClientCommand(command, deps);
     }
+    // ── self-update (unattended-safe update pass; never starts a stopped daemon) ──
+    if (command.kind === "self-update") {
+        return executeSelfUpdate(command, deps);
+    }
     // ── versions command (local install list + published update truth, no daemon socket needed) ──
     if (command.kind === "versions") {
         const versions = deps.listCliVersions?.() ?? [];
@@ -8979,7 +9044,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         if (command.kind === "daemon.status" && (0, cli_render_1.isDaemonUnavailableError)(error)) {
             const message = command.json
                 ? daemonUnavailableStatusJsonOutput(deps.socketPath, deps.healthFilePath)
-                : (0, cli_render_1.daemonUnavailableStatusOutput)(deps.socketPath, deps.healthFilePath);
+                : withUpdateStatusLine((0, cli_render_1.daemonUnavailableStatusOutput)(deps.socketPath, deps.healthFilePath), deps);
             deps.writeStdout(message);
             return message;
         }
@@ -8994,7 +9059,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
     const message = command.kind === "daemon.status"
         ? command.json
             ? formatDaemonStatusJsonOutput(response)
-            : (0, cli_render_1.formatDaemonStatusOutput)(response, fallbackMessage)
+            : withUpdateStatusLine((0, cli_render_1.formatDaemonStatusOutput)(response, fallbackMessage), deps)
         : command.kind === "habit.probe" && command.json
             ? habitProbeJsonResponse(response)
             : fallbackMessage;

package/dist/heart/daemon/cli-help.js

@@ -62,6 +62,12 @@ exports.COMMAND_REGISTRY = {
         usage: "ouro rollback [<version>]",
         example: "ouro rollback 0.1.0-alpha.250",
     },
+    "self-update": {
+        category: "Lifecycle",
+        description: "Update the installed CLI to the newest release from npm or GitHub, restart a running daemon on it, roll back if it fails its checks, and install the hourly launchd updater on macOS",
+        usage: "ouro self-update [--unattended]",
+        example: "ouro self-update",
+    },
     versions: {
         category: "Lifecycle",
         description: "List installed CLI versions and show the active version intent mode and target",

package/dist/heart/daemon/cli-parse.js

@@ -2988,6 +2988,13 @@ function parseOuroCommand(args) {
             throw new Error("Usage: ouro move <agent> here");
         return { kind: "agent.move", agent: second };
     }
+    if (head === "self-update") {
+        const rest = args.slice(1);
+        const unknown = rest.filter((token) => token !== "--unattended");
+        if (unknown.length > 0)
+            throw new Error("Usage: ouro self-update [--unattended]");
+        return { kind: "self-update", ...(rest.includes("--unattended") ? { unattended: true } : {}) };
+    }
     if (head === "stop" || head === "down")
         return { kind: "daemon.stop" };
     if (head === "status") {

package/dist/heart/reply-style.js

@@ -13,7 +13,7 @@ exports.savedCommunicationPreference = savedCommunicationPreference;
  */
 const runtime_1 = require("../nerves/runtime");
 exports.BRIEF_MAX_CHARS = 600;
-const ASK_BRIEF = /\b(?:be|keep(?:\s+(?:it|things|replies|answers|your\s+(?:replies|answers|messages)))?|stay)\s+(?:more\s+)?(?:brief|briefer|concise|terse|short|shorter|tight|compact)\b|\bbrevity\b|\bno\s+sections\b|\bshort\s+(?:answers|replies|messages)\b/i;
+const ASK_BRIEF = /\b(?:be|keep(?:\s+(?:it|things|replies|responses|answers|your\s+(?:replies|responses|answers|messages)))?|stay)\s+(?:more\s+)?(?:brief|briefer|concise|terse|short|shorter|tight|compact)\b|\bbrevity\b|\bno\s+sections\b|\bshort\s+(?:answers|replies|messages)\b/i;
 const ASK_LONGER = /\b(?:be\s+(?:more\s+)?(?:detailed|thorough|verbose|longer)|(?:more|full)\s+detail|elaborate|longer\s+(?:answers|replies)|you\s+can\s+be\s+longer|in\s+depth)\b/i;
 const NEGATED_BRIEF = /\b(?:don['’]?t|do\s+not|stop\s+being|no\s+more|not\s+so|less|never)\s+(?:be\s+|being\s+|so\s+|that\s+)*(?:brief|concise|terse|short|brevity|tight)\b/i;
 /** A reply that asks for a confirmation or a choice the person must make: the question is the point, so brevity does not apply. */
@@ -31,7 +31,6 @@ function briefStyleRequested(userTexts, savedPreference) {
 }
 const HEADER = /^#{1,6}\s/m;
 const BOLD_LABEL = /(?:^|\n)\s*(?:[-*•]\s+)?\*\*[^*\n]{1,60}\*\*[ \t]*(?::|—|-|\n|$)|\*\*[^*\n]{1,60}:\*\*/;
-const SENTENCE_END = /[.!?]+(?:\s+|$)/;
 /** What is wrong with an answer that should be brief, or null when it is fine. */
 function briefStyleViolation(answer, intent) {
     // A blocked reply must say what is blocking, and a reply that asks for a confirmation or a choice must ask it.
@@ -42,9 +41,6 @@ function briefStyleViolation(answer, intent) {
         problems.push("no markdown headers or bold section labels, just plain sentences");
     if (answer.length > exports.BRIEF_MAX_CHARS)
         problems.push(`about ${exports.BRIEF_MAX_CHARS} characters at most (this one is ${answer.length})`);
-    const sentences = answer.split(SENTENCE_END).filter((part) => part.trim());
-    if (sentences.length > 1 && answer.trimEnd().endsWith("?"))
-        problems.push("no closing question tacked onto an answer; answer and stop");
     if (problems.length > 0)
         (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.brief_style_violation", message: "a reply broke the person's brevity request", meta: { problems: problems.length, length: answer.length } });
     return problems.length === 0 ? null : `the person asked you to be brief. rewrite the reply: ${problems.join("; ")}. say the answer once, in your own voice, keep every warning, uncertainty and required confirmation, cut everything else, and settle again.`;

package/dist/heart/shelf-claims.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shelfClaimError = shelfClaimError;
+exports.withShelfDisclosure = withShelfDisclosure;
+/**
+ * "On the shelf" is a promise that a title is in the house library and ready to play. A reply may make it only for a
+ * title a library lookup in this turn found there (2026-10-11: the Butler told Rachel lists were "all on the shelf"
+ * with no lookup, and named titles its own search had just shown were missing). Pure functions; the runtime calls
+ * them at settle for agents that opt in (see ToolContext.answerGates).
+ */
+const runtime_1 = require("../nerves/runtime");
+const SHELF_CLAIM = /\b(?:on\s+(?:the|our)\s+shelf|shelf[- ]ready|ready\s+to\s+(?:play|watch)|in\s+(?:the|our)\s+(?:library|jellyfin))\b/i;
+/** "isn't on the shelf", "check if it's in our library": the same words, but not a claim that something is there. */
+const NOT_A_CLAIM = /\bnot\b|n['’]t\b|\bno\s+longer\b|\bnever\b|\bif\b|\bwhether\b/i;
+/** How far before a claim a denial word still governs it ("Dune isn't on the shelf"; not "No worries, Dune is on the shelf"). */
+const DENIAL_REACH_WORDS = 4;
+const LIBRARY_LOOKUP_TOOLS = new Set(["media_search", "sanctuary_search_media_catalog"]);
+const MIN_TITLE_LENGTH = 3;
+function normalize(text) {
+    return ` ${text.toLowerCase().normalize("NFKD").replace(/[̀-ͯ]/g, "").replace(/&/g, " and ").replace(/[^\p{L}\p{N}]+/gu, " ").trim()} `;
+}
+function titlesFrom(records) {
+    const onShelf = [];
+    const offShelf = [];
+    const add = (list, title) => { if (typeof title === "string" && normalize(title).trim().length >= MIN_TITLE_LENGTH)
+        list.push({ name: title.trim(), key: normalize(title) }); };
+    for (const record of records) {
+        if (!LIBRARY_LOOKUP_TOOLS.has(record.name))
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(record.result);
+        }
+        catch {
+            continue;
+        }
+        const list = (value) => (Array.isArray(value) ? value.filter((item) => item && typeof item === "object") : []);
+        for (const item of list(parsed.items))
+            add(item.on_shelf === true ? onShelf : item.on_shelf === false ? offShelf : [], item.title);
+        for (const item of list(parsed.library_matches))
+            add(item.in_jellyfin === true ? onShelf : [], item.title);
+        for (const item of list(parsed.lookup_candidates))
+            add(offShelf, item.title);
+        // The legacy catalog read lists only what is already in the library.
+        for (const item of list(parsed.data?.items))
+            add(onShelf, item.untrustedTitle);
+    }
+    return { onShelf, offShelf: offShelf.filter((title) => !onShelf.some((found) => found.key === title.key)) };
+}
+/** Null when the reply's shelf claims are backed; otherwise the titles this turn's lookup showed missing (empty: nothing found). */
+function unbackedClaim(answer, tools) {
+    const clauses = answer.split(/[.!?,;\n]+/);
+    const denied = (clause) => NOT_A_CLAIM.test(clause.slice(0, clause.search(SHELF_CLAIM)).trim().split(/\s+/).slice(-DENIAL_REACH_WORDS).join(" "));
+    if (!clauses.some((clause) => SHELF_CLAIM.test(clause) && !denied(clause)))
+        return null;
+    // Titles count from everything but the denials, so "Dune isn't on the shelf" never reads as a claim about Dune.
+    const said = normalize(clauses.filter((clause) => !SHELF_CLAIM.test(clause) || !denied(clause)).join(" "));
+    const { onShelf, offShelf } = titlesFrom(tools);
+    const missing = offShelf.filter((title) => said.includes(title.key)).map((title) => title.name);
+    return onShelf.some((title) => said.includes(title.key)) && missing.length === 0 ? null : { missing };
+}
+/** The correction for a reply that says something is on the shelf without this turn's lookup finding it there, or null. */
+function shelfClaimError(answer, tools) {
+    const claim = unbackedClaim(answer, tools);
+    if (!claim)
+        return null;
+    (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.shelf_claim_unbacked", message: "a reply said something is on the shelf that no lookup this turn found there", meta: { missing: claim.missing.length } });
+    const why = claim.missing.length > 0
+        ? `your library lookup this turn shows ${claim.missing.join(", ")} not on the shelf`
+        : "no library lookup this turn found what you named";
+    return `you said something is on the shelf, but ${why}. say "on the shelf" only for a title a lookup in this turn found there. otherwise say it plainly, like "I can check if we have it", or look it up first.`;
+}
+/** An unbacked shelf claim that survived its retry goes out with the truth in front: what the lookup showed missing, or that nothing was checked. */
+function withShelfDisclosure(answer, tools) {
+    const { missing } = unbackedClaim(answer, tools);
+    const note = missing.length > 0 ? `My lookup shows ${missing.join(", ")} isn't on the shelf.` : "I haven't checked the library for that yet, so I can't promise it's on the shelf.";
+    return `${note}\n\n${answer}`;
+}

package/dist/heart/versioning/ouro-version-manager.js

@@ -240,6 +240,7 @@ function activateVersion(version, deps) {
     const readlinkSync = deps.readlinkSync ?? fs.readlinkSync;
     const unlinkSync = deps.unlinkSync ?? fs.unlinkSync;
     const symlinkSync = deps.symlinkSync ?? fs.symlinkSync;
+    const renameSync = deps.renameSync ?? fs.renameSync;
     const existsSync = deps.existsSync ?? fs.existsSync;
     /* v8 ignore stop */
     const currentVersionPath = path.join(cliHome, "CurrentVersion");
@@ -269,11 +270,33 @@ function activateVersion(version, deps) {
         }
         symlinkSync(oldTarget, previousPath);
     }
-    // Update CurrentVersion symlink
-    if (existsSync(currentVersionPath)) {
-        unlinkSync(currentVersionPath);
+    // Swap CurrentVersion atomically: build the new link beside it and rename
+    // it over the old one, so a process killed mid-swap never leaves the
+    // machine without a CurrentVersion.
+    const tempPath = `${currentVersionPath}.next-${process.pid}`;
+    try {
+        unlinkSync(tempPath);
+    }
+    catch {
+        // No leftover from an earlier interrupted swap.
+    }
+    symlinkSync(newTarget, tempPath);
+    try {
+        renameSync(tempPath, currentVersionPath);
+    }
+    catch {
+        // rename cannot replace a real directory; fall back to unlink + link.
+        try {
+            unlinkSync(tempPath);
+        }
+        catch {
+            // Already gone.
+        }
+        if (existsSync(currentVersionPath)) {
+            unlinkSync(currentVersionPath);
+        }
+        symlinkSync(newTarget, currentVersionPath);
     }
-    symlinkSync(newTarget, currentVersionPath);
 }
 /**
  * Compare two version strings of the form `0.1.0-alpha.{n}`. Returns