@ouro.bot/cli 0.1.0-alpha.903 → 0.1.0-alpha.905

package/dist/heart/versioning/update-state.js

@@ -0,0 +1,126 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UPDATER_INTERVAL_SECONDS = void 0;
+exports.updateStatePath = updateStatePath;
+exports.readUpdateState = readUpdateState;
+exports.writeUpdateState = writeUpdateState;
+exports.formatUpdateStatusLine = formatUpdateStatusLine;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+exports.UPDATER_INTERVAL_SECONDS = 60 * 60;
+function updateStatePath(homeDir = os.homedir()) {
+    return path.join(homeDir, ".ouro-cli", "update-state.json");
+}
+function readUpdateState(deps = {}) {
+    const readFileSync = deps.readFileSync ?? fs.readFileSync;
+    try {
+        const parsed = JSON.parse(readFileSync(updateStatePath(deps.homeDir), "utf8"));
+        if (parsed?.schemaVersion !== 1 || typeof parsed.lastRunAt !== "string" || typeof parsed.outcome !== "string")
+            return null;
+        return {
+            ...parsed,
+            failedVersions: Array.isArray(parsed.failedVersions) ? parsed.failedVersions.filter((v) => typeof v === "string") : [],
+            consecutiveFailures: typeof parsed.consecutiveFailures === "number" ? parsed.consecutiveFailures : 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeUpdateState(state, deps = {}) {
+    const writeFileSync = deps.writeFileSync ?? fs.writeFileSync;
+    const renameSync = deps.renameSync ?? fs.renameSync;
+    const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
+    const destination = updateStatePath(deps.homeDir);
+    mkdirSync(path.dirname(destination), { recursive: true });
+    const temporary = `${destination}.${process.pid}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify(state, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    renameSync(temporary, destination);
+    (0, runtime_1.emitNervesEvent)({
+        level: ["updated", "current", "pinned"].includes(state.outcome) ? "info" : "warn",
+        component: "daemon",
+        event: "daemon.self_update_state_written",
+        message: "recorded the unattended updater outcome",
+        meta: { outcome: state.outcome, currentVersion: state.currentVersion, latestVersion: state.latestVersion ?? null, detail: state.detail ?? null },
+    });
+}
+function formatAge(ms) {
+    const minutes = Math.max(0, Math.round(ms / 60_000));
+    if (minutes < 60)
+        return `${minutes}m ago`;
+    const hours = Math.round(minutes / 60);
+    if (hours < 48)
+        return `${hours}h ago`;
+    return `${Math.round(hours / 24)}d ago`;
+}
+/**
+ * One line for `ouro status`. Problems lead with "needs attention" so a
+ * stuck machine is visible at a glance.
+ */
+function formatUpdateStatusLine(state, options) {
+    if (!state) {
+        return options.updaterInstalled === false
+            ? "Updates: needs attention: the unattended updater is not installed; run `ouro self-update` once"
+            : "Updates: no update check recorded yet; run `ouro self-update`";
+    }
+    const ageMs = options.now - Date.parse(state.lastRunAt);
+    const age = formatAge(ageMs);
+    const stale = ageMs > exports.UPDATER_INTERVAL_SECONDS * 1000 * 3;
+    const version = state.currentVersion ?? "unknown version";
+    let line;
+    switch (state.outcome) {
+        case "updated":
+            line = `Updates: updated to ${version} ${age}${state.source ? ` via ${state.source}` : ""}`;
+            break;
+        case "current":
+            line = `Updates: current at ${version} (checked ${age}${state.source ? ` via ${state.source}` : ""})`;
+            break;
+        case "pinned":
+            line = `Updates: pinned to ${version} (checked ${age}; ${state.detail ?? "pin honored"})`;
+            break;
+        default:
+            line = `Updates: needs attention: ${state.outcome} ${age} on ${version}${state.latestVersion ? ` (latest ${state.latestVersion})` : ""}: ${state.detail ?? "no detail"}`;
+    }
+    if (stale) {
+        line += `; needs attention: the updater has not run since ${state.lastRunAt}`;
+    }
+    if (options.updaterInstalled === false) {
+        line += "; needs attention: the unattended updater is not installed; run `ouro self-update` once";
+    }
+    return line;
+}

package/dist/heart/versioning/updater-launchd.js

@@ -0,0 +1,150 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STABLE_NODE_PATHS = exports.UPDATER_PLIST_LABEL = void 0;
+exports.chooseUpdaterNodePath = chooseUpdaterNodePath;
+exports.updaterPlistPath = updaterPlistPath;
+exports.generateUpdaterPlist = generateUpdaterPlist;
+exports.ensureUpdaterAgent = ensureUpdaterAgent;
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const update_state_1 = require("./update-state");
+/**
+ * A launchd agent that runs `ouro self-update --unattended` every hour and at
+ * login, independent of the Ouro daemon. Updates keep flowing when the
+ * daemon is stopped, crashed, or was never started on this machine.
+ */
+exports.UPDATER_PLIST_LABEL = "bot.ouro.updater";
+/** Node binaries that survive nvm switches and Node upgrades, in preference order. */
+exports.STABLE_NODE_PATHS = ["/opt/homebrew/bin/node", "/usr/local/bin/node"];
+/**
+ * Pick the node binary the updater agent runs. A stable path (Homebrew) is
+ * preferred when it exists and runs the same major Node version as this
+ * process, so the plist does not churn every time another nvm node runs
+ * `ouro up`; otherwise the running node is used.
+ */
+function chooseUpdaterNodePath(options) {
+    for (const candidate of options.candidates ?? exports.STABLE_NODE_PATHS) {
+        if (options.majorOf(candidate) === options.runningMajor)
+            return candidate;
+    }
+    return options.execPath;
+}
+function updaterPlistPath(homeDir) {
+    return path.join(homeDir, "Library", "LaunchAgents", `${exports.UPDATER_PLIST_LABEL}.plist`);
+}
+function xmlEscape(value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function generateUpdaterPlist(options) {
+    const launcher = path.join(options.homeDir, ".ouro-cli", "bin", "ouro-launcher.js");
+    const envPath = [path.dirname(options.nodePath), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"].join(":");
+    return [
+        `<?xml version="1.0" encoding="UTF-8"?>`,
+        `<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">`,
+        `<plist version="1.0">`,
+        `<dict>`,
+        `  <key>Label</key>`,
+        `  <string>${exports.UPDATER_PLIST_LABEL}</string>`,
+        `  <key>ProgramArguments</key>`,
+        `  <array>`,
+        `    <string>${xmlEscape(options.nodePath)}</string>`,
+        `    <string>${xmlEscape(launcher)}</string>`,
+        `    <string>self-update</string>`,
+        `    <string>--unattended</string>`,
+        `  </array>`,
+        `  <key>RunAtLoad</key>`,
+        `  <true/>`,
+        `  <key>StartInterval</key>`,
+        `  <integer>${update_state_1.UPDATER_INTERVAL_SECONDS}</integer>`,
+        `  <key>ProcessType</key>`,
+        `  <string>Background</string>`,
+        `  <key>EnvironmentVariables</key>`,
+        `  <dict>`,
+        `    <key>PATH</key>`,
+        `    <string>${xmlEscape(envPath)}</string>`,
+        `  </dict>`,
+        `</dict>`,
+        `</plist>`,
+        ``,
+    ].join("\n");
+}
+/**
+ * Write the updater plist when it is missing or stale (for example after the
+ * node binary moved) and load it. When the updater agent itself is running,
+ * or another process holds the update lock, reloading would kill the run in
+ * progress, so it only rewrites the file and the next interactive
+ * `ouro self-update` or `ouro up` reloads it.
+ */
+function ensureUpdaterAgent(deps) {
+    const plistPath = updaterPlistPath(deps.homeDir);
+    const desired = generateUpdaterPlist({ homeDir: deps.homeDir, nodePath: deps.nodePath });
+    const existing = deps.readFile(plistPath);
+    const domain = `gui/${deps.userUid}`;
+    let loaded = true;
+    try {
+        deps.exec(`launchctl print ${domain}/${exports.UPDATER_PLIST_LABEL}`);
+    }
+    catch {
+        loaded = false;
+    }
+    if (existing === desired && loaded)
+        return "unchanged";
+    deps.mkdirp(path.dirname(plistPath));
+    deps.writeFile(plistPath, desired);
+    if (deps.runningUnderUpdaterAgent || deps.updateInProgress) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.self_update_agent_written",
+            message: "rewrote the updater launch agent; reload waits for the next interactive run",
+            meta: { plistPath, updateInProgress: deps.updateInProgress },
+        });
+        return "written-reload-pending";
+    }
+    if (loaded) {
+        try {
+            deps.exec(`launchctl bootout ${domain}/${exports.UPDATER_PLIST_LABEL}`);
+        }
+        catch { /* already gone */ }
+    }
+    deps.exec(`launchctl bootstrap ${domain} "${plistPath}"`);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.self_update_agent_installed",
+        message: "installed the unattended updater launch agent",
+        meta: { plistPath, intervalSeconds: update_state_1.UPDATER_INTERVAL_SECONDS },
+    });
+    return "installed";
+}

package/dist/senses/sanctuary-media-catalog-contract.js

@@ -5,10 +5,8 @@ const runtime_1 = require("../nerves/runtime");
 const sanctuary_media_optimization_1 = require("./sanctuary-media-optimization");
 const LEGACY_CATALOG_TOOL = "sanctuary_search_media_catalog";
 const MEDIA_SEARCH_TOOL = "media_search";
-const MEDIA_REQUEST_TOOL = "media_request";
 const HOUSEHOLD_JARGON = /\b(?:bounded|catalog|inventory|endpoint|backend|data shape|pars(?:e|ed|ing)|json|jellyfin|unmanic|sanctuary_search_media_catalog)\b/iu;
 const NEGATED_MEDIA_ACCESS = /\b(?:not|never|none|nothing|zero|inaccessible|invisible|unavailable|broken|failed|failing)\b|\b(?:isn[’']t|won[’']t)\b|\bno\s+access\b|\b(?:lost|lacks?|lacking|without)\s+access\b|\bonly\s+\d|\bfewer\s+than\b|\bsome\s+of\b|\b(?:part|portion|subset)\s+of\b|\bi\s+(?:can(?:not|[’']t)|do\s+not|don[’']t|have\s+no)\b|\bi[’']m\s+not\b/iu;
-const UNSOLICITED_PIVOT = /\b(?:what would you like|what are you in the mood for|would you like me to|do you want me to|want me to|recommend we add)\b/iu;
 const REPORT_LABEL = /(?:^|\n)\s*(?:version|house|the house|render check|status|result)\s*:/iu;
 const TITLE_LIST_GLUE = new Set(["and", "are", "catalog", "film", "films", "from", "have", "here", "in", "is", "library", "movie", "movies", "on", "shelf", "show", "shows", "the", "these", "titles", "we"]);
 const COUNT_ANSWER_GLUE = new Set(["and", "are", "currently", "episodes", "film", "films", "have", "in", "items", "library", "movie", "movies", "on", "shelf", "show", "shows", "the", "there", "tv", "we"]);
@@ -86,7 +84,6 @@ function parseCatalogEvidence(result, args) {
             totalItems: parsed.data.totalItems,
             matchedItems: parsed.data.matchedItems,
             titles,
-            offShelfTitles: [],
             fromMediaSearch: false,
         };
     }
@@ -105,7 +102,6 @@ function parseMediaSearchEvidence(result, args) {
         if (!Number.isSafeInteger(parsed.matched) || !Array.isArray(parsed.items))
             return null;
         const titles = [];
-        const offShelfTitles = [];
         for (const entry of parsed.items) {
             if (!entry || typeof entry !== "object" || Array.isArray(entry))
                 continue;
@@ -113,15 +109,12 @@ function parseMediaSearchEvidence(result, args) {
             if (typeof item.title !== "string" || !item.title.trim())
                 continue;
             titles.push(item.title.trim());
-            if (item.on_shelf === false)
-                offShelfTitles.push(item.title.trim());
         }
         return {
             query: (0, sanctuary_media_optimization_1.normalizeSanctuaryMediaText)(args.query ?? ""),
             totalItems: parsed.matched,
             matchedItems: parsed.matched,
             titles,
-            offShelfTitles,
             fromMediaSearch: true,
         };
     }
@@ -150,14 +143,9 @@ function hasGroundedFirstPersonVisibility(answer, formattedCount) {
     return firstPersonAccess.some((pattern) => pattern.test(answer)) && groundedCount.test(answer);
 }
 function commonAnswerRejection(answer, technicalDetailRequested) {
-    if (/\b(?:just|only|actually|merely)\s+(?:a\s+)?(?:bot|ai|assistant)\b|\bi\s+(?:can[’']?t|cannot|don[’']?t|do not)\s+(?:actually\s+)?watch\b|\bif i had to pick\b/iu.test(answer)) {
-        return "Answer from the catalog evidence with a confident, personable choice; do not retreat into an AI or 'I cannot watch' disclaimer.";
-    }
     if (/\b(?:you'?d|you\s+would|you\s+need\s+to|please)\b.*\b(?:check|look at|poke|nudge)\b.*\b(?:log|logs|dashboard|jellyfin|unmanic)\b/iu.test(answer)) {
         return "Do not send Ari to check Jellyfin, Unmanic, dashboards, or logs for ordinary library visibility while safe catalog tools are available. Use the catalog evidence, or if the catalog read itself fails, say exactly what I could and could not verify.";
     }
-    if (UNSOLICITED_PIVOT.test(answer))
-        return "Answer the media question that was asked, then stop; do not append an unsolicited question or recommendation pivot.";
     if (REPORT_LABEL.test(answer))
         return "Answer conversationally; do not use status-report labels such as version:, house:, render check:, status:, or result:.";
     if (!technicalDetailRequested && HOUSEHOLD_JARGON.test(answer))
@@ -168,7 +156,6 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
     // Prefer media_search when the media surface is installed: it grounds both what is
     // on the shelf and what is worth adding. Fall back to the legacy restricted read.
     const catalogTool = advertisedToolNames.includes(MEDIA_SEARCH_TOOL) ? MEDIA_SEARCH_TOOL : LEGACY_CATALOG_TOOL;
-    const canRequestMedia = advertisedToolNames.includes(MEDIA_REQUEST_TOOL);
     if (!advertisedToolNames.includes(catalogTool))
         return undefined;
     const normalized = (0, sanctuary_media_optimization_1.normalizeSanctuaryMediaText)(request);
@@ -181,9 +168,12 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
     if (operationalOnly || (!mentionsMedia && !requestedTitleQuery) || !asksCatalog)
         return undefined;
     const kind = requestKind(normalized, requestedTitleQuery);
-    const asksForAddition = /\b(?:add|missing from|must get)\b/u.test(normalized);
     const asksForCount = /\b(?:how many|count)\b/u.test(normalized);
     const listCount = requestedListCount(normalized);
+    // Picking something to watch is a conversation, not a catalog read. Forcing a lookup and a title into every reply threw away
+    // the greeting and the questions (2026-10-11, Rach handoff); the shelf-claim answer gate holds whatever a reply says is on the shelf.
+    if (kind === "taste_recommendation" || (kind === "other" && !listCount && !asksForCount))
+        return undefined;
     const technicalDetailRequested = /\b(?:technical|technically|implementation|endpoint|backend|debug|detail|internals?)\b/u.test(normalized);
     let latestEvidence;
     const names = [catalogTool];
@@ -202,11 +192,7 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
                 ? `Use ${catalogTool} before answering. Lead with the direct answer from current catalog evidence, report the shelf count in ordinary household language, and stop without sampled titles or a follow-up question.`
                 : kind === "title_lookup"
                     ? `Use ${catalogTool} with the requested title before answering. Confirm its presence or absence directly from current catalog evidence.`
-                    : kind === "taste_recommendation"
-                        ? `Use ${catalogTool} before answering. Make one concise, decisive choice grounded in returned catalog evidence; do not volunteer an AI or 'I cannot watch' disclaimer.`
-                        : listCount
-                            ? `Use ${catalogTool} with limit ${listCount} before answering, then name exactly the returned catalog titles.`
-                            : `Use ${catalogTool} before answering and base any named titles on the returned catalog evidence.`,
+                    : `Use ${catalogTool} with limit ${listCount} before answering, then name exactly the returned catalog titles.`,
         validateRequiredToolResult(name, result, args) {
             if (name !== catalogTool)
                 return false;
@@ -224,10 +210,6 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
                 return "Search for the requested title by name before answering whether it is on the shelf.";
             if (kind === "title_lookup" && query !== requestedTitleQuery)
                 return `Search for the requested title ${requestedTitleQuery} before answering whether it is on the shelf.`;
-            // media_search browses by genre, keyword and year and reports shelf state per
-            // title, so an addition question does not need a per-candidate title query.
-            if (asksForAddition && !query && catalogTool !== MEDIA_SEARCH_TOOL)
-                return "Search for one candidate title by name before recommending it as an addition.";
             if (listCount && Number(args.limit) !== listCount && catalogTool !== MEDIA_SEARCH_TOOL)
                 return `Set the catalog limit to ${listCount} so the answer is grounded in exactly the requested number of titles.`;
             return undefined;
@@ -264,26 +246,6 @@ function sanctuaryMediaCatalogRequiredToolCalls(request, advertisedToolNames) {
                 if (!includesNormalizedPhrase(answer, requestedTitleQuery))
                     return "Name the requested title in the direct answer.";
             }
-            if (kind === "taste_recommendation" && latest) {
-                if (asksForAddition) {
-                    if (latest.fromMediaSearch) {
-                        // media_search states shelf membership per title, so a recommendation is
-                        // grounded when the named candidate came back marked absent.
-                        if (!latest.offShelfTitles.some((title) => includesNormalizedPhrase(answer, title))) {
-                            return "Recommend only a title the current search returned as not on the shelf.";
-                        }
-                    }
-                    else if (!latest.query || latest.matchedItems !== 0 || !includesNormalizedPhrase(answer, latest.query)) {
-                        return "Recommend an addition only after an exact current catalog search shows that candidate is absent.";
-                    }
-                    if (!canRequestMedia && /\b(?:i|we)\s+(?:added|requested|submitted|queued)\b/iu.test(answer)) {
-                        return "Do not claim the title was added or requested when no media-request action was available.";
-                    }
-                }
-                else if (!latest.titles.some((title) => includesNormalizedPhrase(answer, title))) {
-                    return "Make the choice from a title returned by the current catalog evidence.";
-                }
-            }
             if (kind === "other" && latest) {
                 if (!latest.fromMediaSearch)
                     return catalogTitleGroundingRejection(answer, latest, listCount);

package/dist/senses/sanctuary-runtime.js

@@ -301,8 +301,8 @@ function createSanctuaryToolContext(agentName) {
     });
     return {
         agentRoot,
-        // The Sanctuary profile opts in to the settle-time checks: replies about a work are held to what the turn looked up, and a brevity request is honored.
-        answerGates: { sourceGrounding: true, brevity: true },
+        // The Sanctuary profile opts in to the settle-time checks: replies about a work are held to what the turn looked up, "on the shelf" to what a library lookup found, and a brevity request is honored.
+        answerGates: { sourceGrounding: true, brevity: true, shelfClaims: true },
         sanctuary: {
             // The model-facing list carries the steward policy's desired state beside docker's: a container kept stopped on purpose is not a fault. The restart path reads the plain list.
             listContainers: acceptanceRead("unraid_list_containers", async (signal) => (0, sanctuary_container_policy_1.annotateContainers)(signal ? await reads.listContainers(signal) : await reads.listContainers(), currentStewardPolicy(agentRoot), Date.now())),

package/dist/senses/telegram-handoff.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OWNER_CHAT_HANDOFF_MS = void 0;
+exports.ownerChatHandedOff = ownerChatHandedOff;
+exports.readHeldNotices = readHeldNotices;
+exports.writeHeldNotices = writeHeldNotices;
+/**
+ * Ari sometimes hands his Telegram chat to someone else ("I'm going to hand you to my wife, Rachel"). For a while after that,
+ * the chat is that person's conversation, so house notices (an outage, a recovery) wait instead of landing in it
+ * (2026-10-11: two Jellyfin outage notes went into Rachel's movie chat). The window runs until the chat has been quiet for two
+ * hours, so a long conversation is never interrupted. Pure functions plus a small held-notice file; the Telegram sense wires them in.
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const session_events_1 = require("../heart/session-events");
+const runtime_1 = require("../nerves/runtime");
+exports.OWNER_CHAT_HANDOFF_MS = 2 * 60 * 60 * 1000;
+const HANDOFF_CUE = /\b(?:hand(?:ing)?|pass(?:ing)?)\s+you\s+(?:(?:over|off)\s+)?to\b|\bsay\s+(?:hi|hello)\s+to\s+(?:her|him|them)\b/i;
+/** True when the owner's chat was handed to someone else and has had a message from them within the window. */
+function ownerChatHandedOff(events, now) {
+    let lastMessageAt = null;
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event.role !== "user")
+            continue;
+        lastMessageAt ??= Date.parse(event.time.observedAt ?? event.time.recordedAt);
+        if (HANDOFF_CUE.test((0, session_events_1.extractEventText)(event)))
+            return Number.isFinite(lastMessageAt) && now - lastMessageAt < exports.OWNER_CHAT_HANDOFF_MS;
+    }
+    return false;
+}
+function readHeldNotices(filePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        return Array.isArray(parsed) ? parsed.filter((entry) => typeof entry?.key === "string" && typeof entry?.text === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+function writeHeldNotices(filePath, notices) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const temporary = `${filePath}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, JSON.stringify(notices), { mode: 0o600 });
+    fs.renameSync(temporary, filePath);
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.telegram_held_notices_saved", message: "saved the house notices held during a handoff", meta: { held: notices.length } });
+}

package/dist/senses/telegram.js

@@ -85,6 +85,7 @@ const sanctuary_grounding_1 = require("./sanctuary-grounding");
 const telegram_approval_runtime_1 = require("./telegram-approval-runtime");
 const telegram_audit_ledger_1 = require("./telegram-audit-ledger");
 const session_events_1 = require("../heart/session-events");
+const telegram_handoff_1 = require("./telegram-handoff");
 const router_1 = require("../heart/external-events/router");
 const session_transaction_1 = require("../mind/session-transaction");
 const approval_files_1 = require("../heart/approval-files");
@@ -1128,6 +1129,45 @@ function createTelegramSenseApp(options) {
             ...(onMessageDelivered ? { onMessageDelivered } : {}),
         });
     };
+    // House notices wait while Ari's chat is handed to someone else, then go out with the next notice, message or reconcile pass
+    // (see telegram-handoff). Releases run one at a time so two callers never send the same held notice twice, and a notice leaves the
+    // held file before it is sent: from then on the effect journal owns it, exactly like a notice that was never held.
+    const heldNoticesPath = path.join(agentRoot, "state", "telegram", "held-owner-notices.json");
+    const ownerChatIsHandedOff = () => {
+        const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
+        return (0, telegram_handoff_1.ownerChatHandedOff)((0, session_events_1.loadSessionEnvelopeFile)(sessionPath)?.events ?? [], Date.now());
+    };
+    const holdNoticeDuringHandoff = (text, key) => {
+        if (!ownerChatIsHandedOff())
+            return false;
+        const held = (0, telegram_handoff_1.readHeldNotices)(heldNoticesPath);
+        if (!held.some((notice) => notice.key === key))
+            (0, telegram_handoff_1.writeHeldNotices)(heldNoticesPath, [...held, { key, text }]);
+        (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.telegram_notice_held_for_handoff", message: "held a house notice while the owner's chat is handed to someone else", meta: { agentName: options.agentName } });
+        return true;
+    };
+    let heldNoticeRelease = Promise.resolve();
+    const releaseHeldNotices = async (signal) => {
+        // Nearly always nothing is held: return without queueing, so ordinary turns and the reconcile tick pay nothing.
+        if ((0, telegram_handoff_1.readHeldNotices)(heldNoticesPath).length === 0)
+            return;
+        const release = heldNoticeRelease.then(async () => {
+            const held = (0, telegram_handoff_1.readHeldNotices)(heldNoticesPath);
+            if (ownerChatIsHandedOff())
+                return;
+            const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
+            for (const notice of held) {
+                (0, telegram_handoff_1.writeHeldNotices)(heldNoticesPath, (0, telegram_handoff_1.readHeldNotices)(heldNoticesPath).filter((entry) => entry.key !== notice.key));
+                await recordAcceptedEffects(sessionPath, [await deliverButlerEffect(notice.text, notice.key, signal)]);
+            }
+        });
+        heldNoticeRelease = release.catch(() => undefined);
+        await release;
+    };
+    /** For callers that must not fail because a held notice failed to send; the effect journal keeps the failed send. */
+    const releaseHeldNoticesQuietly = () => releaseHeldNotices().catch((error) => {
+        (0, runtime_1.emitNervesEvent)({ level: "error", component: "senses", event: "senses.telegram_held_notice_release_error", message: "a held house notice failed to send; the effect journal has it", meta: { agentName: options.agentName, subject, error: transportError(error) } });
+    });
     recordAcceptedEffects = async (sessionPath, artifacts, bootstrapInbound, causalEventIds) => {
         await (0, telegram_effect_adapter_1.recordTelegramEffectsInSession)({ store: getEffectJournal(), sessionPath, artifacts, ...(bootstrapInbound ? { inbound: bootstrapInbound } : {}), ...(causalEventIds ? { causalEventIds } : {}) });
         for (const artifact of artifacts) {
@@ -1179,6 +1219,7 @@ function createTelegramSenseApp(options) {
     });
     const failsafeScanCache = new router_1.ExternalEventScanCache();
     reconcileSystemFailsafes = async () => {
+        await releaseHeldNoticesQuietly();
         if (!options.privilegedFailsafe)
             return;
         const target = configuredOwnerTarget();
@@ -1503,6 +1544,7 @@ function createTelegramSenseApp(options) {
         const turnEffects = [];
         let deliveryOrdinal = 0;
         await recoverEffectOutbox();
+        await releaseHeldNoticesQuietly();
         let ingressRelations = { replyToEventId: null, threadRootEventId: null, references: [inboundReference] };
         if (message.replyToMessageId && /^[1-9][0-9]*$/u.test(message.replyToMessageId)) {
             const replyMessageId = Number(message.replyToMessageId);
@@ -1902,7 +1944,11 @@ function createTelegramSenseApp(options) {
                     });
                     return;
                 }
-                const effect = await deliverButlerEffect(proactiveText, `proactive:${(0, node_crypto_1.randomUUID)()}`, signal);
+                const key = `proactive:${(0, node_crypto_1.randomUUID)()}`;
+                if (holdNoticeDuringHandoff(proactiveText, key))
+                    return;
+                await releaseHeldNotices(signal);
+                const effect = await deliverButlerEffect(proactiveText, key, signal);
                 const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
                 await recordAcceptedEffects(sessionPath, [effect]);
             });
@@ -1914,7 +1960,11 @@ function createTelegramSenseApp(options) {
                 throw new Error("Telegram external event identity is invalid");
             await runWithAcceptanceAuditOwner(async () => {
                 const receiptIdentity = JSON.stringify([source, eventId, input.generation]);
-                const effect = await deliverButlerEffect(requiredText(input.text, "external event decision"), `external-event:${receiptIdentity}`, input.signal);
+                const text = requiredText(input.text, "external event decision");
+                if (holdNoticeDuringHandoff(text, `external-event:${receiptIdentity}`))
+                    return;
+                await releaseHeldNotices(input.signal);
+                const effect = await deliverButlerEffect(text, `external-event:${receiptIdentity}`, input.signal);
                 const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
                 await recordAcceptedEffects(sessionPath, [effect]);
             });
@@ -1927,7 +1977,11 @@ function createTelegramSenseApp(options) {
             if (Buffer.byteLength(noticeId) > 512)
                 throw new Error("Telegram owner notice id is invalid");
             await runWithAcceptanceAuditOwner(async () => {
-                const effect = await deliverButlerEffect(requiredText(input.text, "owner notice"), `owner-notice:${noticeId}`, input.signal);
+                const text = requiredText(input.text, "owner notice");
+                if (holdNoticeDuringHandoff(text, `owner-notice:${noticeId}`))
+                    return;
+                await releaseHeldNotices(input.signal);
+                const effect = await deliverButlerEffect(text, `owner-notice:${noticeId}`, input.signal);
                 const sessionPath = (0, shared_turn_1.getSenseSessionPath)(options.agentName, configuredOwnerFriendId, "telegram", configuredOwnerSessionKey, agentRoot);
                 await recordAcceptedEffects(sessionPath, [effect]);
             });

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.903",
+  "version": "0.1.0-alpha.905",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.903",
+      "version": "0.1.0-alpha.905",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.903",
+  "version": "0.1.0-alpha.905",
   "engines": {
     "node": ">=22"
   },
@@ -36,6 +36,7 @@
     "test": "vitest run",
     "test:integration": "npm run build && vitest run --config vitest.integration.config.ts",
     "test:e2e:package": "npm run build && node scripts/package-e2e.cjs",
+    "test:e2e:self-update": "node scripts/self-update-package-e2e.cjs",
     "test:e2e:ouro-bot-package": "node scripts/ouro-bot-package-e2e.cjs",
     "test:e2e:real-smoke": "npm run build && node scripts/nightly-real-smoke.cjs",
     "typecheck:mailbox-ui": "tsc --noEmit -p packages/mailbox-ui/tsconfig.json",