@ouro.bot/cli 0.1.0-alpha.914 → 0.1.0-alpha.915

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.915",
+      "changes": [
+        "BlueBubbles (iMessage) only acts as the Apple ID of the macOS account an agent declares as senses.bluebubbles.hostUsername. Before every send, edit, typing indicator, read receipt and health check, Ouro confirms the BlueBubbles server runs under that account (wherever Ouro itself runs), and refuses otherwise; every send rechecks. The sense also registers its webhook only on a server under that account rechecks before taking in each incoming webhook event, and refuses to read messages (catch-up, queued recovery, message lookups, bluebubbles replay and context-smoke) from a server it cannot confirm, so an agent never reads another account's iMessages either; queued messages stay queued until it can. The sense, send_message and RSVP sends are all covered. With no declared host, BlueBubbles does not start or send, ouro doctor fails (as does its webhook check when the server runs under another account), and the agent does not see it as ready. ouro connect bluebubbles asks for the host account by name and records it before installing, and ouro bluebubbles host install|repair refuses undeclared accounts."
+      ]
+    },
     {
       "version": "0.1.0-alpha.914",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.914",
+  "runtimeVersion": "0.1.0-alpha.915",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.914</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.915</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/bluebubbles-host-account.js

@@ -0,0 +1,78 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.currentOsAccount = currentOsAccount;
+exports.checkBlueBubblesHostDeclared = checkBlueBubblesHostDeclared;
+exports.checkBlueBubblesHostTarget = checkBlueBubblesHostTarget;
+const os = __importStar(require("os"));
+const runtime_1 = require("../nerves/runtime");
+const HUMAN_DECISION = "Choosing senses.bluebubbles.hostUsername is a human decision, because it chooses whose Apple ID the agent speaks as.";
+function currentOsAccount() {
+    const info = os.userInfo();
+    return { username: info.username, uid: info.uid };
+}
+function refuse(reason, message, meta) {
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "senses",
+        event: "senses.bluebubbles_host_account_refused",
+        message: "refused BlueBubbles outside its declared macOS host account",
+        meta: { reason, ...meta },
+    });
+    return { ok: false, reason, message };
+}
+/** Does `agent` declare its iMessage host account at all? */
+function checkBlueBubblesHostDeclared(agent, hostUsername) {
+    if (hostUsername !== undefined)
+        return { ok: true };
+    return refuse("unset", `BlueBubbles refused for agent "${agent}": no host account is declared (senses.bluebubbles.hostUsername), so Ouro cannot tell whose Apple ID would send. `
+        + `Not starting. Fix: a human sets senses.bluebubbles.hostUsername in agent.json to the macOS account signed in to the agent's own Apple ID. ${HUMAN_DECISION}`, { agent });
+}
+/**
+ * May the BlueBubbles server be installed or repaired under `targetUsername`?
+ * Only if some agent with BlueBubbles enabled declares that account as its host.
+ */
+function checkBlueBubblesHostTarget(targetUsername, declared) {
+    if (declared.some((entry) => entry.hostUsername === targetUsername))
+        return { ok: true };
+    const withHost = declared.filter((entry) => entry.hostUsername !== undefined);
+    if (withHost.length === 0) {
+        return refuse("unset", `BlueBubbles host setup refused for macOS account "${targetUsername}": no agent with BlueBubbles enabled declares senses.bluebubbles.hostUsername. `
+            + `Fix: a human declares the macOS account signed in to the agent's own Apple ID as senses.bluebubbles.hostUsername. ${HUMAN_DECISION}`, { targetUsername });
+    }
+    const hosts = withHost.map((entry) => `${entry.agent} -> "${entry.hostUsername}"`).join(", ");
+    return refuse("mismatch", `BlueBubbles host setup refused for macOS account "${targetUsername}": no agent declares it as its iMessage host (declared: ${hosts}). `
+        + `Set up BlueBubbles under a declared account instead. ${HUMAN_DECISION}`, { targetUsername, hosts });
+}

package/dist/heart/daemon/cli-exec.js

@@ -53,6 +53,7 @@ exports.setupBlueBubblesHostForConnect = setupBlueBubblesHostForConnect;
 exports.resolveMailImportFilePath = resolveMailImportFilePath;
 exports.runOuroCli = runOuroCli;
 const child_process_1 = require("child_process");
+const bluebubbles_host_account_1 = require("../bluebubbles-host-account");
 const crypto_1 = require("crypto");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -2891,6 +2892,15 @@ function enableAgentSense(agent, sense, deps) {
     };
     fs.writeFileSync(configPath, `${JSON.stringify(raw, null, 2)}\n`, "utf-8");
 }
+/** Record `senses.bluebubbles.hostUsername` in agent.json, leaving the enabled flag as it is. */
+function declareBlueBubblesHost(agent, hostUsername, deps) {
+    // readAgentConfigForAgent has already validated senses (an object when present).
+    const { configPath } = (0, auth_flow_1.readAgentConfigForAgent)(agent, deps.bundlesRoot);
+    const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const senses = raw.senses ?? {};
+    raw.senses = { ...senses, bluebubbles: { ...(senses.bluebubbles ?? { enabled: false }), hostUsername } };
+    fs.writeFileSync(configPath, `${JSON.stringify(raw, null, 2)}\n`, "utf-8");
+}
 const CONNECT_MENU_PROMPT = "Choose [1-9] or type a name: ";
 function connectMenuIsTTY(deps) {
     return deps.isTTY ?? process.stdout.isTTY === true;
@@ -3687,6 +3697,36 @@ async function executeConnectTeams(agent, deps) {
         ],
     });
 }
+/** Host accounts declared by every bundle agent that has BlueBubbles enabled. */
+function declaredBlueBubblesHosts(bundlesRoot) {
+    let entries;
+    try {
+        entries = fs.readdirSync(bundlesRoot, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const declared = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() || !entry.name.endsWith(".ouro"))
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(path.join(bundlesRoot, entry.name, "agent.json"), "utf-8"));
+        }
+        catch {
+            continue;
+        }
+        const bluebubbles = parsed.senses?.bluebubbles;
+        if (bluebubbles?.enabled !== true)
+            continue;
+        const hostUsername = typeof bluebubbles.hostUsername === "string" && bluebubbles.hostUsername.trim()
+            ? bluebubbles.hostUsername.trim()
+            : undefined;
+        declared.push({ agent: entry.name.slice(0, -".ouro".length), ...(hostUsername ? { hostUsername } : {}) });
+    }
+    return declared;
+}
 async function setupBlueBubblesHostForConnect(bridgeUsername, serverUrl, requestTimeoutMs, deps, hostAccountDeps = {
     userInfo: os.userInfo,
     execFileSync: child_process_1.execFileSync,
@@ -3781,8 +3821,20 @@ async function executeConnectBlueBubbles(agent, deps) {
     const ownHandles = ownHandlesRaw
         ? ownHandlesRaw.split(",").map((h) => h.trim()).filter((h) => h.length > 0)
         : [];
-    const bridgeUsernameAnswer = (await promptInput(`BlueBubbles macOS account username [${os.userInfo().username}]: `)).trim();
-    const bridgeUsername = bridgeUsernameAnswer || os.userInfo().username;
+    // iMessage sends as whichever Apple ID the host account is signed in to, so the
+    // host account is declared explicitly (never defaulted to whoever runs this).
+    const declaredHost = (0, auth_flow_1.readAgentConfigForAgent)(agent, deps.bundlesRoot).config.senses?.bluebubbles.hostUsername;
+    const bridgeUsernameAnswer = (await promptInput(declaredHost
+        ? `BlueBubbles macOS account username [${declaredHost}]: `
+        : `macOS account signed in to ${agent}'s own Apple ID (BlueBubbles host): `)).trim();
+    const bridgeUsername = bridgeUsernameAnswer || declaredHost;
+    if (!bridgeUsername)
+        throw new Error(`BlueBubbles host account cannot be blank: name the macOS account signed in to ${agent}'s own Apple ID`);
+    if (declaredHost) {
+        const hostCheck = (0, bluebubbles_host_account_1.checkBlueBubblesHostTarget)(bridgeUsername, [{ agent, hostUsername: declaredHost }]);
+        if (!hostCheck.ok)
+            throw new Error(hostCheck.message);
+    }
     const machineId = currentMachineId(deps);
     const progress = createHumanCommandProgress(deps, "connect bluebubbles");
     let stored;
@@ -3797,6 +3849,8 @@ async function executeConnectBlueBubbles(agent, deps) {
             progress.end();
             throw new Error(`cannot read existing machine runtime credentials from ${current.itemPath}: ${current.error}`);
         }
+        // Declare the host account before installing anything under it.
+        declareBlueBubblesHost(agent, bridgeUsername, deps);
         progress.updateDetail("configuring native BlueBubbles host continuity");
         hostSetup = await setupBlueBubblesHostForConnect(bridgeUsername, serverUrl, requestTimeoutMs, deps);
         const blueBubblesPatch = {
@@ -3831,6 +3885,7 @@ async function executeConnectBlueBubbles(agent, deps) {
             machineId,
             requestTimeoutMs,
             listenerReady: (0, bluebubbles_cli_integration_1.blueBubblesListenerReadyAfterApply)(daemonApply),
+            hostUsername: bridgeUsername,
         };
         webhookRegistration = await (0, bluebubbles_cli_integration_1.reconcileBlueBubblesWebhookAfterConnect)(webhookInput, {
             ...(deps.reconcileBlueBubblesWebhook ? { reconcile: deps.reconcileBlueBubblesWebhook } : {}),
@@ -6692,6 +6747,13 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         return text;
     }
     if (command.kind === "bluebubbles.host") {
+        if (command.action === "install" || command.action === "repair") {
+            // Only an account some agent declares as its iMessage host may get a BlueBubbles server.
+            const targetUsername = command.target?.username ?? (0, bluebubbles_host_account_1.currentOsAccount)().username;
+            const hostCheck = (0, bluebubbles_host_account_1.checkBlueBubblesHostTarget)(targetUsername, declaredBlueBubblesHosts(deps.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)()));
+            if (!hostCheck.ok)
+                throw new Error(hostCheck.message);
+        }
         if (command.target) {
             (0, bluebubbles_host_1.installBlueBubblesHostSharedHelper)({
                 assetPath: path.resolve(__dirname, "../../../assets/bluebubbles-host"),

package/dist/heart/daemon/doctor.js

@@ -240,6 +240,7 @@ const DEFINITIVE_BLUEBUBBLES_WEBHOOK_STATES = new Set([
     "auth-failed",
     "malformed",
     "listener-not-ready",
+    "host-account-refused",
 ]);
 function blueBubblesUpstreamEvidence(probe) {
     if (probe.ok)
@@ -463,10 +464,19 @@ async function checkSenses(deps) {
                     });
                     continue;
                 }
+                const hostUsername = typeof senseObj.hostUsername === "string" ? senseObj.hostUsername.trim() : "";
+                if (!hostUsername) {
+                    checks.push({
+                        label: `${agentDir} bluebubbles host account`,
+                        status: "fail",
+                        detail: "no host account declared (senses.bluebubbles.hostUsername); BlueBubbles will not start or send. A human sets it to the macOS account signed in to the agent's own Apple ID.",
+                    });
+                    continue;
+                }
                 checks.push({
                     label: `${agentDir} bluebubbles config`,
                     status: "pass",
-                    detail: serverUrl,
+                    detail: `${serverUrl} (host account ${hostUsername})`,
                 });
                 let upstreamContext = "upstream probe not run in this pass";
                 let infrastructure = { upstream: "not-run", webhook: null };
@@ -496,6 +506,7 @@ async function checkSenses(deps) {
                         machineId,
                         requestTimeoutMs,
                         listenerReady: true,
+                        hostUsername,
                     }, { fetchImpl: deps.fetchImpl });
                     checks.push({
                         id: "senses.bluebubbles.webhook",

package/dist/heart/daemon/sense-manager.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DaemonSenseManager = void 0;
 const fs = __importStar(require("fs"));
+const bluebubbles_host_account_1 = require("../bluebubbles-host-account");
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
@@ -111,6 +112,11 @@ function readAgentSenses(agentJsonPath) {
         const enabled = rawSense.enabled;
         if (typeof enabled === "boolean") {
             defaults[sense] = { enabled };
+            const hostUsername = rawSense.hostUsername;
+            // A missing or malformed host account stays unset, so BlueBubbles fails closed.
+            if (sense === "bluebubbles" && typeof hostUsername === "string" && hostUsername.trim().length > 0) {
+                defaults[sense] = { enabled, hostUsername: hostUsername.trim() };
+            }
         }
     }
     if (workbenchHasStaleBundleEntry) {
@@ -244,6 +250,12 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
                         : runtimeConfigUnavailableDetail(agent, machineRuntimeConfig),
             };
     }
+    if (senses.bluebubbles.enabled && base.bluebubbles.configured) {
+        // Attached here, but whose Apple ID? Without a declared host, never start.
+        const declared = (0, bluebubbles_host_account_1.checkBlueBubblesHostDeclared)(agent, senses.bluebubbles.hostUsername);
+        if (!declared.ok)
+            base.bluebubbles = { configured: false, hostRefused: true, detail: declared.message };
+    }
     if (senses.mail.enabled) {
         const privateKeys = mailroom?.privateKeys;
         const hasPrivateKeys = !!privateKeys && typeof privateKeys === "object" && !Array.isArray(privateKeys) && Object.values(privateKeys).some((value) => typeof value === "string" && value.trim().length > 0);
@@ -856,15 +868,20 @@ class DaemonSenseManager {
         if (!context || !context.senses[parsed.sense].enabled)
             return null;
         const managedName = `${parsed.agent}:${parsed.sense}`;
+        const currentRow = () => this.listSenseRows().find((row) => row.agent === parsed.agent && row.sense === parsed.sense) ?? null;
         const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
         const needsMachineConfig = needsMachineRuntimeConfig(parsed.agent, parsed.sense);
         const machineRuntimeConfig = needsMachineConfig
             ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
             : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
         context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, runtimeConfig, machineRuntimeConfig, context.workbenchHasStaleBundleEntry);
+        if (context.facts[parsed.sense].hostRefused) {
+            // Never start iMessage without a declared host account.
+            return currentRow();
+        }
         this.processManager.resetAgentFailureState?.(managedName);
         await this.processManager.startAgent?.(managedName);
-        return this.listSenseRows().find((row) => row.agent === parsed.agent && row.sense === parsed.sense) ?? null;
+        return currentRow();
     }
     listSenseRows() {
         const runtime = new Map();

package/dist/heart/identity.js

@@ -200,6 +200,21 @@ function normalizeSenses(value, configFile) {
             });
             throw new Error(`agent.json at ${configFile} must include senses.${senseName}.enabled as boolean.`);
         }
+        const hostUsername = rawSense.hostUsername;
+        if (senseName === "bluebubbles" && hostUsername !== undefined) {
+            if (typeof hostUsername !== "string" || hostUsername.trim().length === 0) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    event: "config_identity.error",
+                    component: "config/identity",
+                    message: "agent config has invalid BlueBubbles host username",
+                    meta: { path: configFile, sense: senseName },
+                });
+                throw new Error(`agent.json at ${configFile}: senses.bluebubbles.hostUsername must be a non-empty string.`);
+            }
+            defaults[senseName] = { enabled, hostUsername: hostUsername.trim() };
+            continue;
+        }
         defaults[senseName] = { enabled };
     }
     return defaults;

package/dist/heart/turn-context.js

@@ -205,7 +205,9 @@ function readSenseStatusLines() {
     const configured = {
         cli: true,
         teams: hasTextField(teams, "clientId") && hasTextField(teams, "clientSecret") && hasTextField(teams, "tenantId"),
-        bluebubbles: hasTextField(bluebubbles, "serverUrl") && hasTextField(bluebubbles, "password"),
+        // Without a declared host account, every BlueBubbles send is refused, so it is not ready.
+        bluebubbles: hasTextField(bluebubbles, "serverUrl") && hasTextField(bluebubbles, "password")
+            && config.senses?.bluebubbles?.hostUsername !== undefined,
         mail: hasTextField(mailroom, "mailboxAddress") && !!privateKeys && typeof privateKeys === "object" && !Array.isArray(privateKeys),
         /* v8 ignore next 5 -- full voice mode matrix lives in the voice runtime resolver; this row only mirrors that result into prompt context @preserve */
         voice: voiceConversationEngine === "openai-sip"

package/dist/rsvp/cli.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.rsvpBlueBubblesHostOptions = rsvpBlueBubblesHostOptions;
 exports.runRsvpCliCommand = runRsvpCliCommand;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
@@ -329,6 +330,15 @@ function recordField(record, key) {
         ? value
         : null;
 }
+/** The agent's declared iMessage host account; an unreadable config leaves it unset, so sending fails closed. */
+function rsvpBlueBubblesHostOptions(agent, agentRoot) {
+    try {
+        return { agent, hostUsername: (0, identity_1.loadAgentConfig)({ agentName: agent, agentRoot }).senses?.bluebubbles.hostUsername };
+    }
+    catch {
+        return { agent, hostUsername: undefined };
+    }
+}
 function rsvpBlueBubblesClientConfig(nativeConfig, machineRuntimeConfig) {
     if (!machineRuntimeConfig.ok) {
         throw new Error(`BlueBubbles runtime config unavailable at ${machineRuntimeConfig.itemPath}: ${machineRuntimeConfig.error}`);
@@ -721,7 +731,7 @@ async function executeRefreshInner(command, deps, transportCounter, hardNoSend)
             };
         }
         const bluebubbles = rsvpBlueBubblesClientConfig(configResult.config, machineRuntimeConfig);
-        const client = (0, client_1.createBlueBubblesClient)(bluebubbles.config, bluebubbles.channelConfig);
+        const client = (0, client_1.createBlueBubblesClient)(bluebubbles.config, bluebubbles.channelConfig, rsvpBlueBubblesHostOptions(command.agent, agentRoot));
         sendBoundary = await (0, outbound_state_1.executeRsvpSendBoundary)({
             agentRoot,
             habitId: command.habitName,
@@ -880,7 +890,7 @@ async function executeSmoke(command, deps) {
     let delivery;
     if (sendAllowed) {
         const bluebubbles = rsvpBlueBubblesClientConfig(configResult.config, await resolveRsvpMachineRuntimeCredentialConfig(command.agent));
-        const sent = await (0, client_1.createBlueBubblesClient)(bluebubbles.config, bluebubbles.channelConfig).sendText({
+        const sent = await (0, client_1.createBlueBubblesClient)(bluebubbles.config, bluebubbles.channelConfig, rsvpBlueBubblesHostOptions(command.agent, agentRoot)).sendText({
             chat: blueBubblesChatFor(configResult.config),
             text: answer.text,
         });

package/dist/senses/bluebubbles/client.js

@@ -44,6 +44,7 @@ const minimax_1 = require("../../heart/providers/minimax");
 const minimax_vlm_1 = require("../../heart/providers/minimax-vlm");
 const model_1 = require("./model");
 const media_1 = require("./media");
+const host_account_verifier_1 = require("./host-account-verifier");
 class BlueBubblesSendError extends Error {
     httpStatus;
     status;
@@ -303,13 +304,27 @@ async function resolveChatGuid(chat, config, channelConfig) {
     return chat.chatGuid
         ?? await resolveChatGuidForIdentifier(config, channelConfig, chat.chatIdentifier ?? "");
 }
-function createBlueBubblesClient(config = (0, config_1.getBlueBubblesConfig)(), channelConfig = (0, config_1.getBlueBubblesChannelConfig)()) {
+function createBlueBubblesClient(config = (0, config_1.getBlueBubblesConfig)(), channelConfig = (0, config_1.getBlueBubblesChannelConfig)(), hostOptions = {}) {
+    // Everything that acts as the signed-in Apple ID first confirms the server
+    // runs under the agent's declared macOS host account.
+    // Sends recheck every time; quieter actions may reuse a recent confirmation.
+    const assertHostAccount = (options = {}) => (0, host_account_verifier_1.verifyBlueBubblesServerAccount)({
+        agent: hostOptions.agent ?? (0, identity_1.getAgentName)(),
+        hostUsername: "hostUsername" in hostOptions
+            ? hostOptions.hostUsername
+            : (0, identity_1.loadAgentConfig)().senses?.bluebubbles.hostUsername,
+        serverUrl: config.serverUrl,
+        password: config.password,
+        requestTimeoutMs: channelConfig.requestTimeoutMs,
+        fresh: options.fresh,
+    });
     return {
         async sendText(params) {
             const trimmedText = params.text.trim();
             if (!trimmedText) {
                 throw new Error("BlueBubbles send requires non-empty text.");
             }
+            await assertHostAccount({ fresh: true });
             const resolvedChatGuid = await resolveChatGuid(params.chat, config, channelConfig);
             if (!resolvedChatGuid) {
                 throw new Error("BlueBubbles send currently requires chat.chatGuid from the inbound event.");
@@ -411,6 +426,7 @@ function createBlueBubblesClient(config = (0, config_1.getBlueBubblesConfig)(),
             return { messageGuid };
         },
         async editMessage(params) {
+            await assertHostAccount();
             const messageGuid = params.messageGuid.trim();
             const text = params.text.trim();
             if (!messageGuid) {
@@ -437,6 +453,7 @@ function createBlueBubblesClient(config = (0, config_1.getBlueBubblesConfig)(),
             }
         },
         async setTyping(chat, typing, signal) {
+            await assertHostAccount();
             const resolvedChatGuid = await resolveChatGuid(chat, config, channelConfig);
             if (!resolvedChatGuid) {
                 return;
@@ -453,6 +470,7 @@ function createBlueBubblesClient(config = (0, config_1.getBlueBubblesConfig)(),
             }
         },
         async markChatRead(chat, signal) {
+            await assertHostAccount();
             const resolvedChatGuid = await resolveChatGuid(chat, config, channelConfig);
             if (!resolvedChatGuid) {
                 return;
@@ -497,6 +515,7 @@ function createBlueBubblesClient(config = (0, config_1.getBlueBubblesConfig)(),
                 });
                 throw new Error(result.detail);
             }
+            await assertHostAccount();
             (0, runtime_1.emitNervesEvent)({
                 component: "senses",
                 event: "senses.bluebubbles_healthcheck_end",
@@ -507,6 +526,8 @@ function createBlueBubblesClient(config = (0, config_1.getBlueBubblesConfig)(),
         async queryRecentMessagesWithMetadata(params = {}) {
             const limit = Math.max(1, Math.min(100, Math.floor(params.limit ?? 50)));
             const offset = Math.max(0, Math.floor(params.offset ?? 0));
+            // Reading messages is gated like sending: never read another account's iMessages.
+            await assertHostAccount();
             const url = buildBlueBubblesApiUrl(config.serverUrl, "/api/v1/message/query", config.password);
             (0, runtime_1.emitNervesEvent)({
                 component: "senses",
@@ -618,6 +639,7 @@ function createBlueBubblesClient(config = (0, config_1.getBlueBubblesConfig)(),
                     eventType: event.eventType,
                 },
             });
+            await assertHostAccount();
             const url = buildRepairUrl(config.serverUrl, event.messageGuid, config.password);
             try {
                 const response = await fetch(url, {
@@ -748,6 +770,7 @@ function createBlueBubblesClient(config = (0, config_1.getBlueBubblesConfig)(),
             }
         },
         async getMessageText(messageGuid) {
+            await assertHostAccount();
             const url = buildRepairUrl(config.serverUrl, messageGuid, config.password);
             try {
                 const response = await fetch(url, {

package/dist/senses/bluebubbles/host-account-verifier.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BlueBubblesHostAccountError = void 0;
+exports.resetBlueBubblesServerAccountCache = resetBlueBubblesServerAccountCache;
+exports.verifyBlueBubblesServerAccount = verifyBlueBubblesServerAccount;
+const runtime_1 = require("../../nerves/runtime");
+/**
+ * BlueBubbles acts as whichever Apple ID is signed in to the macOS account its
+ * server runs under, wherever Ouro itself runs. Before anything that acts as
+ * that Apple ID (sending, editing, typing, read receipts), confirm the server
+ * reports the agent's declared host account; the inbound webhook and its
+ * registration are gated the same way, so the agent neither speaks nor listens
+ * as another account's Apple ID. BlueBubbles server info reports `computer_id`
+ * as `<macOS username>@<hostname>`. Anything unconfirmed fails closed.
+ */
+class BlueBubblesHostAccountError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BlueBubblesHostAccountError";
+    }
+}
+exports.BlueBubblesHostAccountError = BlueBubblesHostAccountError;
+const VERIFIED_TTL_MS = 60_000;
+const verifiedAt = new Map();
+/** Test seam: forget cached verifications. */
+function resetBlueBubblesServerAccountCache() {
+    verifiedAt.clear();
+}
+function refuse(message, meta) {
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "senses",
+        event: "senses.bluebubbles_host_account_refused",
+        message: "refused BlueBubbles action outside the agent's declared host account",
+        meta,
+    });
+    throw new BlueBubblesHostAccountError(message);
+}
+function serverInfoUrl(serverUrl, password) {
+    const root = serverUrl.endsWith("/") ? serverUrl : `${serverUrl}/`;
+    const url = new URL("api/v1/server/info", root);
+    url.searchParams.set("password", password);
+    return url.toString();
+}
+async function readServerUsername(input) {
+    try {
+        const response = await (input.fetchImpl ?? fetch)(serverInfoUrl(input.serverUrl, input.password), {
+            method: "GET",
+            signal: AbortSignal.timeout(input.requestTimeoutMs),
+        });
+        if (!response.ok)
+            return null;
+        const body = await response.json();
+        const computerId = body?.data?.computer_id;
+        if (typeof computerId !== "string")
+            return null;
+        const at = computerId.indexOf("@");
+        const username = at > 0 ? computerId.slice(0, at) : "";
+        return username || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function verifyBlueBubblesServerAccount(input) {
+    const { agent, hostUsername, serverUrl } = input;
+    if (hostUsername === undefined) {
+        refuse(`BlueBubbles refused for agent "${agent}": no host account is declared (senses.bluebubbles.hostUsername), so Ouro cannot tell whose Apple ID this is. `
+            + "Not acting. Fix: a human sets senses.bluebubbles.hostUsername in agent.json to the macOS account signed in to the agent's own Apple ID.", { agent, reason: "unset" });
+    }
+    const now = (input.now ?? Date.now)();
+    const key = `${serverUrl}\u0000${hostUsername}`;
+    const cached = verifiedAt.get(key);
+    if (!input.fresh && cached !== undefined && now - cached < VERIFIED_TTL_MS)
+        return;
+    const serverUsername = await readServerUsername(input);
+    if (serverUsername === null) {
+        verifiedAt.delete(key);
+        refuse(`BlueBubbles refused for agent "${agent}": could not confirm which macOS account the BlueBubbles server at ${serverUrl} runs under. Not acting.`, { agent, reason: "unconfirmed", hostUsername });
+    }
+    if (serverUsername !== hostUsername) {
+        verifiedAt.delete(key);
+        refuse(`BlueBubbles refused for agent "${agent}": the BlueBubbles server at ${serverUrl} runs under macOS account "${serverUsername}", `
+            + `but the agent's iMessage host is "${hostUsername}". Not acting, so the agent neither speaks nor listens as "${serverUsername}"'s Apple ID. `
+            + `Fix: run BlueBubbles under "${hostUsername}" and point bluebubbles.serverUrl at it. Changing senses.bluebubbles.hostUsername is a human decision, because it chooses whose Apple ID the agent speaks as.`, { agent, reason: "mismatch", hostUsername, serverUsername });
+    }
+    verifiedAt.set(key, now);
+}

package/dist/senses/bluebubbles/index.js

@@ -78,6 +78,7 @@ const proactive_content_guard_1 = require("../proactive-content-guard");
 const bluebubbles_meta_guard_1 = require("../bluebubbles-meta-guard");
 const model_1 = require("./model");
 const client_1 = require("./client");
+const host_account_verifier_1 = require("./host-account-verifier");
 const webhook_registration_1 = require("./webhook-registration");
 const inbound_log_1 = require("./inbound-log");
 const mutation_log_1 = require("./mutation-log");
@@ -308,6 +309,16 @@ const defaultDeps = {
     },
     recordProcessed: processed_log_1.recordProcessedBlueBubblesMessage,
     withSessionTurnLease: session_transaction_1.withSessionTurnLease,
+    // Incoming events recheck every time, like sends, so a server that takes over
+    // the same URL under another account is refused immediately.
+    verifyHostAccount: () => (0, host_account_verifier_1.verifyBlueBubblesServerAccount)({
+        agent: (0, identity_1.getAgentName)(),
+        hostUsername: (0, identity_1.loadAgentConfig)().senses?.bluebubbles.hostUsername,
+        serverUrl: (0, config_1.getBlueBubblesConfig)().serverUrl,
+        password: (0, config_1.getBlueBubblesConfig)().password,
+        requestTimeoutMs: (0, config_1.getBlueBubblesChannelConfig)().requestTimeoutMs,
+        fresh: true,
+    }),
 };
 const BLUEBUBBLES_RUNTIME_SYNC_INTERVAL_MS = 30_000;
 const BLUEBUBBLES_RECOVERY_PASS_DELAY_MS = 1_000;
@@ -2804,6 +2815,22 @@ async function recoverQueuedBlueBubblesMessages(deps = {}, options = {}) {
     if (initialPending === 0) {
         return { recovered: 0, skipped: 0, failed: 0, pendingRecoveryCount: 0 };
     }
+    // Recovery re-reads queued messages from the server, so it only runs against
+    // a server confirmed to be under the agent's own host account. Queued work
+    // stays queued (not failed) until it is.
+    try {
+        await resolvedDeps.verifyHostAccount();
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "senses",
+            event: "senses.bluebubbles_recovery_host_refused",
+            message: "skipped bluebubbles recovery because the server's host account is not confirmed",
+            meta: { pendingRecoveryCount: initialPending, reason: error instanceof Error ? error.message : String(error) },
+        });
+        return { recovered: 0, skipped: 0, failed: 0, pendingRecoveryCount: initialPending };
+    }
     const captured = await recoverCapturedBlueBubblesInboundMessages(resolvedDeps, options);
     options.lifecycleSignal?.throwIfAborted();
     const recovery = await recoverMissedBlueBubblesMessages(resolvedDeps);
@@ -3198,6 +3225,15 @@ function createBlueBubblesWebhookHandler(deps = {}, options = {}) {
             writeJson(res, 401, { error: "Unauthorized" });
             return;
         }
+        // Only take in messages from the agent's own Apple ID: a server running
+        // under another macOS account would hand the agent that person's iMessages.
+        try {
+            await { ...defaultDeps, ...deps }.verifyHostAccount();
+        }
+        catch (error) {
+            writeJson(res, 403, { handled: false, notifiedAgent: false, error: error instanceof Error ? error.message : String(error) });
+            return;
+        }
         let payload;
         try {
             const rawBody = await readRequestBody(req);
@@ -3828,6 +3864,7 @@ function startBlueBubblesApp(deps = {}) {
             machineId: (0, machine_identity_1.loadOrCreateMachineIdentity)().machineId,
             requestTimeoutMs: channelConfig.requestTimeoutMs,
             listenerReady: true,
+            hostUsername: (0, identity_1.loadAgentConfig)().senses?.bluebubbles.hostUsername,
         });
         (0, runtime_1.emitNervesEvent)({
             component: "channels",

package/dist/senses/bluebubbles/webhook-registration.js

@@ -9,6 +9,7 @@ exports.reconcileBlueBubblesWebhookRegistration = reconcileBlueBubblesWebhookReg
 exports.createBlueBubblesWebhookReconciler = createBlueBubblesWebhookReconciler;
 const crypto_1 = require("crypto");
 const runtime_1 = require("../../nerves/runtime");
+const host_account_verifier_1 = require("./host-account-verifier");
 exports.BLUEBUBBLES_WEBHOOK_RECONCILE_INTERVAL_MS = 180_000;
 function result(state, detail, counts = {}) {
     return {
@@ -131,10 +132,35 @@ function inspectHooks(hooks, input) {
         exactCount: exact.length,
     });
 }
+/**
+ * A webhook subscribes the agent to every message of the Apple ID the server runs
+ * as, so registering or inspecting one first confirms that is the agent's own
+ * declared host account. Returns a refusal result, or null when confirmed.
+ */
+async function refuseForeignHostAccount(input, fetchImpl) {
+    try {
+        await (0, host_account_verifier_1.verifyBlueBubblesServerAccount)({
+            agent: input.agentName,
+            hostUsername: input.hostUsername,
+            serverUrl: input.serverUrl,
+            password: input.password,
+            requestTimeoutMs: input.requestTimeoutMs,
+            fetchImpl,
+        });
+        return null;
+    }
+    catch (error) {
+        return result("host-account-refused", error instanceof Error ? error.message : String(error));
+    }
+}
 async function inspectBlueBubblesWebhookRegistration(input, deps = {}) {
     if (!input.listenerReady)
         return result("listener-not-ready", "the local BlueBubbles listener is not ready");
-    const listed = await readHooks(input, deps.fetchImpl ?? fetch, deps.signal);
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const refused = await refuseForeignHostAccount(input, fetchImpl);
+    if (refused)
+        return refused;
+    const listed = await readHooks(input, fetchImpl, deps.signal);
     return "hooks" in listed ? inspectHooks(listed.hooks, input) : listed;
 }
 async function mutate(input, fetchImpl, method, id, signal) {
@@ -152,6 +178,9 @@ async function reconcileBlueBubblesWebhookRegistration(input, deps = {}) {
     if (!input.listenerReady)
         return result("listener-not-ready", "the local BlueBubbles listener is not ready");
     const fetchImpl = deps.fetchImpl ?? fetch;
+    const refused = await refuseForeignHostAccount(input, fetchImpl);
+    if (refused)
+        return refused;
     const listed = await readHooks(input, fetchImpl, deps.signal);
     if (!("hooks" in listed))
         return listed;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.914",
+  "version": "0.1.0-alpha.915",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.914",
+      "version": "0.1.0-alpha.915",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.914",
+  "version": "0.1.0-alpha.915",
   "engines": {
     "node": ">=22"
   },