@ouro.bot/cli 0.1.0-alpha.947 → 0.1.0-alpha.950

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.950",
+      "changes": [
+        "Slugger's model calls work again: Ouro now identifies as a current Claude Code release, so the API stops refusing claude-opus-5-5, and Shepherd's check-ins and notices resume.",
+        "Saving an operator trust file twice in the same millisecond no longer fails: the second backup takes the next free name, and no backup is ever overwritten."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.948",
+      "changes": [
+        "A Butler upgrade's automatic rollback no longer fails when the stopping gateway removes its lock file mid-read, and host supervision now stays paused for the whole upgrade, replay gate and rollback included, instead of waking up after 30 minutes."
+      ]
+    },
     {
       "version": "0.1.0-alpha.947",
       "changes": [

package/deploy/unraid/sanctuary-butler-upgrade.mjs

@@ -40,7 +40,7 @@
 // Usage: sanctuary-butler-upgrade.mjs <preflight|prepare|install|verify|upgrade> <version> [--rehearse <step>] [--no-gate] [--plant <case>]
 //        sanctuary-butler-upgrade.mjs verify [--gate]
 
-import { execFileSync, spawnSync } from "node:child_process"
+import { execFileSync, spawn, spawnSync } from "node:child_process"
 import { createHash } from "node:crypto"
 import { mkdtempSync, rmSync, writeFileSync, readFileSync, existsSync, statSync, lstatSync, chmodSync, realpathSync, readdirSync } from "node:fs"
 import { fileURLToPath } from "node:url"
@@ -67,7 +67,8 @@ const INCOMING_MANIFEST = `${ROOT}/incoming-package-manifest.json`
 const INCOMING_REQUEST = `${ROOT}/incoming-request.json`
 const UPGRADE_JOURNAL = `${ROOT}/upgrade.json`
 // Host supervision skips its work while this flag is fresh (< 30 min), so a crashed
-// upgrade can never leave self-heal off for longer than that.
+// upgrade can never leave self-heal off for longer than that. A paused upgrade keeps it
+// fresh with a heartbeat (holdSupervision), because the replay gate alone takes about an hour.
 const MAINTENANCE = "/run/ouro-authority-maintenance"
 // The stop hook's flag: every keeper watchdog version stands down while it exists.
 const SHUTDOWN_FLAG = "/run/ouro-authority-shutdown"
@@ -958,6 +959,20 @@ function buildFinalProof(version, out) {
 
 // ---- upgrade (in place, installed authority) --------------------------------
 
+/**
+ * Keeps host supervision paused for as long as this upgrade process lives, gate and rollback included: a detached
+ * shell touches the maintenance flag every interval while the parent is alive. It never recreates a released flag
+ * (touch -c). Once the parent is gone, however it ended, the shell drops the shutdown flag (which never expires) and
+ * stops, so the maintenance flag ages out and self-heal returns within about 30 minutes of a crash.
+ */
+export const SUPERVISION_HOLD_SH = 'while kill -0 "$1" 2>/dev/null; do touch -c "$2"; sleep "$4"; done; rm -f "$3"'
+export function holdSupervision({ spawnImpl = spawn, parentPid = process.pid, flag = MAINTENANCE, shutdownFlag = SHUTDOWN_FLAG, intervalSec = 60 } = {}) {
+  const child = spawnImpl("/bin/sh", ["-c", SUPERVISION_HOLD_SH, "ouro-supervision-hold", String(parentPid), flag, shutdownFlag, String(intervalSec)], { detached: true, stdio: "ignore" })
+  child.unref()
+  return child
+}
+let HOLD = null
+
 // A host still running an older keeper has a cron watchdog that ignores the maintenance
 // flag: it resurrected the paused supervisor, which restarted the resident mid-upgrade
 // (the first 830 -> 835 rehearsal). So put this version's keeper scripts in place first
@@ -966,6 +981,7 @@ function buildFinalProof(version, out) {
 function pauseSupervision() {
   writeFileSync(MAINTENANCE, `${new Date().toISOString()} ${process.pid}\n`)
   writeFileSync(SHUTDOWN_FLAG, `upgrade ${process.pid}\n`)
+  HOLD ??= holdSupervision()
   for (const [path, body] of [[GATEWAY_SUPERVISOR, GATEWAY_SUPERVISOR_SH], [GATEWAY_WATCHDOG, GATEWAY_WATCHDOG_SH]]) {
     writeFileSync(path, body)
     sh("/bin/chown", ["0:0", path]); chmodSync(path, 0o700)
@@ -975,6 +991,7 @@ function pauseSupervision() {
   ok("host supervision paused (keeper scripts current; flags expire on their own)")
 }
 function resumeSupervision() {
+  if (HOLD) { try { process.kill(-HOLD.pid, "SIGTERM") } catch { /* already gone; touch -c cannot recreate the flag */ } HOLD = null }
   rmSync(MAINTENANCE, { force: true })
   rmSync(SHUTDOWN_FLAG, { force: true })
   installGatewaySupervisor()
@@ -1005,6 +1022,10 @@ function pruneButlerImages() {
   ok(`pruned ${removed} old Butler image(s); kept the live and rollback images`)
 }
 
+// A failed rollback exits with supervision still paused: the keeper's boot would retry the rollback alongside a manual
+// retry (the 945 rollback on 2026-10-25). The flag then ages out and the keeper's boot retries it on its own.
+const ROLLBACK_FAILED = (e, lifecycle) => `ROLLBACK FAILED: ${lifecycleFailure(e)}\nThe journal is kept. Host supervision stays paused for about 30 minutes; after that the keeper's authority boot retries the rollback. To retry by hand sooner, keep it paused while you do: \`touch ${MAINTENANCE}; node ${lifecycle} upgrade-rollback\` (repeat the touch if the retry is slow).`
+
 function lifecycleFailure(e) {
   const detail = [e.stderr, e.stdout].map((x) => (x ? String(x).trim() : "")).filter(Boolean).join(" | ")
   let last = ""
@@ -1131,12 +1152,10 @@ async function upgrade(version, rehearse, { noGate = false, plant } = {}) {
   if (failure) {
     console.log(`\n!! ${planned ? "rehearsal stopped as planned" : "upgrade FAILED"}: ${reason}\n!! rolling back to the predecessor`)
     try { ok(`rollback: ${sh("/usr/local/bin/node", [lifecycle, "upgrade-rollback"], { stdio: ["ignore", "pipe", "pipe"] }).trim()}`) }
-    catch (e) {
-      resumeSupervision()
-      fail(`ROLLBACK FAILED: ${lifecycleFailure(e)}\nThe journal is kept; the next authority boot (or \`upgrade-rollback\`) retries it.`)
-    }
+    catch (e) { fail(ROLLBACK_FAILED(e, lifecycle)) }
   } else if (!gated) { pinTemplate(version); pruneButlerImages() }
-  resumeSupervision()
+  // A held upgrade stays paused through the gate; commit or rollback resumes it.
+  if (!gated || failure) resumeSupervision()
   say("preservation")
   const preserved = []
   const jellyfinNow = docker(["inspect", "jellyfin", "--format", "{{.Id}}|{{.Image}}|{{.RestartCount}}|{{.State.StartedAt}}"]).trim()
@@ -1158,17 +1177,18 @@ async function upgrade(version, rehearse, { noGate = false, plant } = {}) {
         return problem ? { ok: false, detail: problem } : result
       },
       commit: () => {
-        const problem = stillHeld()
-        if (problem) throw new Error(`refusing to commit: ${problem}`)
         pauseSupervision()
-        try { ok(`commit: ${sh("/usr/local/bin/node", [lifecycle, "upgrade", id, image(version)], { stdio: ["ignore", "pipe", "pipe"] }).trim()}`) }
-        finally { resumeSupervision() }
+        try {
+          const problem = stillHeld()
+          if (problem) throw new Error(`refusing to commit: ${problem}`)
+          ok(`commit: ${sh("/usr/local/bin/node", [lifecycle, "upgrade", id, image(version)], { stdio: ["ignore", "pipe", "pipe"] }).trim()}`)
+        } finally { resumeSupervision() }
       },
       rollback: () => {
         pauseSupervision()
         try { ok(`rollback: ${sh("/usr/local/bin/node", [lifecycle, "upgrade-rollback"], { stdio: ["ignore", "pipe", "pipe"] }).trim()}`) }
-        catch (e) { fail(`ROLLBACK FAILED: ${lifecycleFailure(e)}\nThe journal is kept; the next authority boot (or \`upgrade-rollback\`) retries it.`) }
-        finally { resumeSupervision() }
+        catch (e) { fail(ROLLBACK_FAILED(e, lifecycle)) }
+        resumeSupervision()
       },
       confirmRollback: () => {
         if (!waitForButler(priorImage, 300)) fail(`rolled back, but ${priorImage} is not running healthy; inspect \`docker logs ${CONTAINER}\``)

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.947",
+  "runtimeVersion": "0.1.0-alpha.950",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.947</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.950</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/a2a/operator-trust.js

@@ -329,6 +329,24 @@ function createExclusive(file, body) {
         fs.closeSync(fd);
     }
 }
+const MAX_BACKUP_SUFFIX = 99;
+/**
+ * Keeps the previous bytes under the timestamped name, or under the first free `-1`, `-2`, ... variant when two writes
+ * land in the same millisecond. Every attempt is an exclusive create, so an existing backup is never overwritten.
+ */
+function createBackup(base, previous) {
+    for (let suffix = 0;; suffix++) {
+        const candidate = suffix === 0 ? base : `${base}-${suffix}`;
+        try {
+            createExclusive(candidate, previous);
+            return candidate;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST" || suffix >= MAX_BACKUP_SUFFIX)
+                throw error;
+        }
+    }
+}
 function rawBytes(file) {
     let fd;
     try {
@@ -345,7 +363,7 @@ function rawBytes(file) {
 }
 /**
  * Replaces one file in the trust directory. The previous bytes are kept beside it as a timestamped backup, created the
- * same safe way. The new file is written to an exclusive random temporary name, owned and moded through its descriptor,
+ * same safe way and never overwriting an earlier one. The new file is written to an exclusive random temporary name, owned and moded through its descriptor,
  * fsynced and renamed into place, so a reader never sees a half-written file and nothing already on disk is followed.
  */
 function writeTrustedFile(agentRoot, fileName, body, now) {
@@ -355,8 +373,7 @@ function writeTrustedFile(agentRoot, fileName, body, now) {
     const previous = rawBytes(file);
     let backup = null;
     if (previous) {
-        backup = `${file}.bak-${now.toISOString().replace(/[:.]/gu, "-")}`;
-        createExclusive(backup, previous);
+        backup = createBackup(`${file}.bak-${now.toISOString().replace(/[:.]/gu, "-")}`, previous);
         fsyncDirectory(dir);
     }
     const tmp = path.join(dir, `.${fileName}.${(0, node_crypto_1.randomBytes)(8).toString("hex")}.tmp`);

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -75,6 +75,11 @@ const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 // page cache on Unraid's array that takes minutes, so readiness gets a generous budget
 // (a 120 s budget failed a real rollback on 2026-09-24).
 const GATEWAY_READY_TIMEOUT_MS = 900_000;
+const RESIDENT_READY_TIMEOUT_MS = 300_000;
+// A rolled-back predecessor older than 0.1.0-alpha.947 starts its senses behind a startup external-event turn and took about 8 minutes to become ready on 2026-10-25.
+const PREDECESSOR_READY_TIMEOUT_MS = 900_000;
+// How long an operator upgrade or rollback waits for the deployment lease while a keeper boot holds it. A boot can be running the whole rollback: halt, bundle finalize, gateway readiness and the predecessor's 15 minutes.
+const OPERATOR_LEASE_WAIT_MS = 1_800_000;
 const GATEWAY_START_BACKOFF_MS = [2_000, 10_000, 30_000];
 const GATEWAY_LOG_TAIL_CHARS = 2_000;
 // Read more than is shown, so masking sees whole tokens before the tail is cut.
@@ -495,7 +500,17 @@ class SanctuaryAuthorityRootLifecycle {
         const lock = `${this.#epochRoot()}/authority.lock`;
         if (!fs.existsSync(this.#p(lock)))
             return null;
-        const pid = Number(this.#private(lock));
+        let text;
+        try {
+            text = this.#private(lock);
+        }
+        catch (error) {
+            // An exiting gateway unlinks its lock, which can land mid-read (ENOENT, or nlink 0). A lock that is gone means no gateway; one still present stays strict.
+            if (!fs.existsSync(this.#p(lock)))
+                return null;
+            throw error;
+        }
+        const pid = Number(text);
         if (!Number.isSafeInteger(pid) || pid <= 0)
             throw new Error("Sanctuary gateway process lock is invalid");
         if (!fs.existsSync(this.#p(`/proc/${pid}`)))
@@ -861,7 +876,7 @@ class SanctuaryAuthorityRootLifecycle {
         if (this.#containers().find((container) => container.Name === "/ouro-butler")?.Image !== journal.from.imageId) {
             predecessor.#recreateResident(journal.from.imageReference, journal.from.imageId);
         }
-        await predecessor.#startUpgraded();
+        await predecessor.#startUpgraded(PREDECESSOR_READY_TIMEOUT_MS);
         this.#remove(UPGRADE);
         this.#removeTree(PREVIOUS);
         (0, runtime_1.emitNervesEvent)({ level: "warn", component: "daemon", event: "daemon.sanctuary_upgrade_rolled_back", message: "Sanctuary upgrade rolled back to its predecessor", meta: { from: journal.to.imageReference, to: journal.from.imageReference } });
@@ -1039,11 +1054,11 @@ class SanctuaryAuthorityRootLifecycle {
         fs.rmSync(path.join(directory, "window.json"), { force: true, recursive: true });
     }
     /** Start the gateway, then the resident, and prove both. */
-    async #startUpgraded() {
+    async #startUpgraded(readyTimeoutMs = RESIDENT_READY_TIMEOUT_MS) {
         this.#runtimeDirectories();
         await this.#startGateway();
         this.#docker(["start", "ouro-butler"]);
-        await this.#wait(async () => this.#target().State.Running && this.#target().State.Health?.Status === "healthy" && await this.#ready(), 300_000);
+        await this.#wait(async () => this.#target().State.Running && this.#target().State.Health?.Status === "healthy" && await this.#ready(), readyTimeoutMs);
     }
     #removeTree(absolute) {
         fs.rmSync(this.#p(absolute), { recursive: true, force: true });
@@ -1257,7 +1272,7 @@ async function runSanctuaryAuthorityRootCli(argv, write = (text) => process.stdo
         }
         else
             await lifecycle.boot();
-    }, { timeoutMs: upgrade || rollback ? 600_000 : 0, confinementRoot: "/boot/config/custom/ouro-butler" });
+    }, { timeoutMs: upgrade || rollback ? OPERATOR_LEASE_WAIT_MS : 0, confinementRoot: "/boot/config/custom/ouro-butler" });
 }
 if (process.argv[1] && fs.existsSync(process.argv[1]) && fs.realpathSync(process.argv[1]) === __filename) {
     void runSanctuaryAuthorityRootCli(process.argv.slice(2)).catch((error) => {

package/dist/heart/providers/anthropic.js

@@ -49,6 +49,9 @@ const error_classification_1 = require("./error-classification");
 const ANTHROPIC_SETUP_TOKEN_PREFIX = "sk-ant-oat01-";
 const ANTHROPIC_SETUP_TOKEN_MIN_LENGTH = 80;
 const ANTHROPIC_OAUTH_BETA_HEADER = "claude-code-20250219,oauth-2025-04-20,fine-grained-tool-streaming-2025-05-14,interleaved-thinking-2025-05-14";
+// The API refuses newer models to Claude Code versions it considers too old (claude-opus-5-5 needs 2.1.280 or newer),
+// so this names a current release. Raise it when the API asks for a newer one.
+const CLAUDE_CLI_USER_AGENT = "claude-cli/2.1.310 (external, cli)";
 function getAnthropicAgentNameForGuidance() {
     return (0, identity_1.getAgentName)();
 }
@@ -455,7 +458,7 @@ function createAnthropicProviderRuntime(model, anthropicConfig = (0, config_1.ge
             defaultHeaders: {
                 "anthropic-beta": ANTHROPIC_OAUTH_BETA_HEADER,
                 "anthropic-dangerous-direct-browser-access": "true",
-                "user-agent": "claude-cli/2.1.2 (external, cli)",
+                "user-agent": CLAUDE_CLI_USER_AGENT,
                 "x-app": "cli",
             },
         });

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.947",
+  "version": "0.1.0-alpha.950",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.947",
+      "version": "0.1.0-alpha.950",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.947",
+  "version": "0.1.0-alpha.950",
   "engines": {
     "node": ">=22"
   },