@ouro.bot/cli 0.1.0-alpha.981 → 0.1.0-alpha.982

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.982",
+      "changes": [
+        "An agent's psyche and friend records can no longer be reached by a write through a relative path, a case-altered path or a symlink."
+      ]
+    },
     {
       "version": "0.1.0-alpha.981",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.981",
+  "runtimeVersion": "0.1.0-alpha.982",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.981</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.982</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/repertoire/guardrails.js

@@ -34,6 +34,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OURO_CLI_TRUST_MANIFEST = void 0;
+exports.canonicalTarget = canonicalTarget;
+exports.insideAgentFolder = insideAgentFolder;
 exports.guardInvocation = guardInvocation;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
@@ -42,6 +44,7 @@ const friends_1 = require("@ouro.bot/friends");
 const shell_quote_1 = require("shell-quote");
 const runtime_1 = require("../nerves/runtime");
 const store_1 = require("../commerce/store");
+const identity_1 = require("../heart/identity");
 const deny = (reason) => ({ allowed: false, reason });
 const allow = { allowed: true };
 // --- reason templates ---
@@ -70,10 +73,68 @@ const PROTECTED_PATH_SEGMENTS = [
     "state/reports/",
 ];
 const PROTECTED_FILENAMES = ["agent.json", "tool-profiles.json"];
-/** The agent's psyche folder ships only from the repository (a pull request and the replay gate), so no tool writes into it. */
+/** How many symlinks a dangling-link walk follows before refusing (the Linux kernel's own limit is 40). */
+const MAX_SYMLINK_HOPS = 40;
+/** A lookup that failed only because part of the path does not exist yet; any other failure leaves the target unknown. */
+function rethrowUnlessMissing(error) {
+    const code = error.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR")
+        throw error;
+}
+/**
+ * The real location of `lexical`: `realpathSync.native` of the deepest part that exists, the final file included, with the
+ * missing remainder appended. A dangling symlink is followed, from its real parent, to where a write through it would land.
+ * Throws when the filesystem cannot say where the path lands (a denied lookup, a symlink loop, too many links), so the
+ * guard can refuse rather than fall back to the lexical path.
+ */
+function canonicalize(lexical) {
+    let current = lexical;
+    const missing = [];
+    let hops = 0;
+    for (;;) {
+        try {
+            return path.join(fs.realpathSync.native(current), ...missing);
+        }
+        catch (error) {
+            rethrowUnlessMissing(error);
+        }
+        let stat;
+        try {
+            stat = fs.lstatSync(current);
+        }
+        catch (error) {
+            rethrowUnlessMissing(error);
+        }
+        if (stat?.isSymbolicLink()) {
+            if (hops >= MAX_SYMLINK_HOPS)
+                throw new Error(`too many symbolic links resolving ${lexical}`);
+            hops += 1;
+            current = path.resolve(fs.realpathSync.native(path.dirname(current)), fs.readlinkSync(current));
+            continue;
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return path.join(current, ...missing);
+        missing.unshift(path.basename(current));
+        current = parent;
+    }
+}
+/**
+ * Every place a file tool could write `p`: resolved against the agent root and against the repo root (which is what
+ * `write_file` and `edit_file` use), each in its lexical and canonical form. An absolute `p` is resolved only as itself.
+ */
+function canonicalTarget(p, agentRoot) {
+    const lexicals = path.isAbsolute(p) ? [p] : [path.resolve(agentRoot, p), path.resolve((0, identity_1.getRepoRoot)(), p)];
+    return lexicals.flatMap((lexical) => [lexical, canonicalize(lexical)]);
+}
+/** True when any form of `p` is the agent's `folder` (in either its lexical or its canonical form) or under it. */
+function insideAgentFolder(p, agentRoot, folder) {
+    const lexicalFolder = path.resolve(agentRoot, folder);
+    const folders = [lexicalFolder, canonicalize(lexicalFolder)];
+    return canonicalTarget(p, agentRoot).some((target) => folders.some((dir) => target === dir || target.startsWith(`${dir}${path.sep}`)));
+}
+/** The agent's psyche folder ships only from the repository (a pull request and the replay gate), so no tool writes into it. The shell check uses this lexical form; the file tools use `insideAgentFolder`. */
 function isPsychePath(filePath, agentRoot) {
-    if (!agentRoot || !filePath)
-        return false;
     const psyche = path.resolve(agentRoot, "psyche");
     const target = path.resolve(agentRoot, filePath);
     return target === psyche || target.startsWith(`${psyche}${path.sep}`);
@@ -85,8 +146,6 @@ function isPsychePath(filePath, agentRoot) {
  * only: a shell can still write anywhere its uid can, which is why delegated-command authority lives outside the bundle.
  */
 function isFriendsStorePath(filePath, agentRoot) {
-    if (!agentRoot || !filePath)
-        return false;
     const store = path.resolve(agentRoot, "friends");
     const target = path.resolve(agentRoot, filePath);
     return target === store || target.startsWith(`${store}${path.sep}`);
@@ -272,9 +331,21 @@ function checkDestructiveShellPatterns(toolName, args) {
 function checkProtectedPaths(toolName, args, context) {
     if (toolName === "write_file" || toolName === "edit_file") {
         const filePath = args.path || "";
-        if (isPsychePath(filePath, context.agentRoot))
-            return deny(REASONS.psychePath);
-        if (isProtectedPath(filePath) || isFriendsStorePath(filePath, context.agentRoot))
+        // The file tools resolve a relative path against the repo root and follow symlinks, so the guard checks every form.
+        // A path whose landing place the filesystem cannot report is refused rather than checked lexically.
+        const agentRoot = filePath ? context.agentRoot : undefined;
+        if (agentRoot) {
+            try {
+                if (insideAgentFolder(filePath, agentRoot, "psyche"))
+                    return deny(REASONS.psychePath);
+                if (insideAgentFolder(filePath, agentRoot, "friends"))
+                    return deny(REASONS.protectedPath);
+            }
+            catch {
+                return deny(REASONS.protectedPath);
+            }
+        }
+        if (isProtectedPath(filePath))
             return deny(REASONS.protectedPath);
     }
     if (toolName === "shell") {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.981",
+  "version": "0.1.0-alpha.982",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.981",
+      "version": "0.1.0-alpha.982",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.981",
+  "version": "0.1.0-alpha.982",
   "engines": {
     "node": ">=22"
   },