@ouro.bot/cli 0.1.0-alpha.981 → 0.1.0-alpha.983

package/dist/repertoire/guardrails.js

@@ -33,7 +33,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OURO_CLI_TRUST_MANIFEST = void 0;
+exports.OURO_CLI_TRUST_MANIFEST = exports.PSYCHE_REFUSAL = void 0;
+exports.canonicalTarget = canonicalTarget;
+exports.insideAgentFolder = insideAgentFolder;
+exports.psycheFileClass = psycheFileClass;
+exports.psycheWriteAllowed = psycheWriteAllowed;
+exports.psycheEditNote = psycheEditNote;
 exports.guardInvocation = guardInvocation;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
@@ -42,6 +47,7 @@ const friends_1 = require("@ouro.bot/friends");
 const shell_quote_1 = require("shell-quote");
 const runtime_1 = require("../nerves/runtime");
 const store_1 = require("../commerce/store");
+const identity_1 = require("../heart/identity");
 const deny = (reason) => ({ allowed: false, reason });
 const allow = { allowed: true };
 // --- reason templates ---
@@ -50,7 +56,6 @@ const REASONS = {
     readBeforeEdit: "i need to read that file first before i can edit it.",
     readBeforeOverwrite: "i need to read that file first before i can overwrite it.",
     protectedPath: "that path is protected — i can read it but not modify it.",
-    psychePath: "my psyche files ship from the repository through a pull request and the replay gate; i can read them but not change them. i file the change request with Claude Code instead.",
     destructiveCommand: "that command is too dangerous to run — it could cause irreversible damage.",
     // Trust reasons (vary by relationship)
     needsTrust: "i'd need a closer friend to vouch for you before i can do that.",
@@ -70,10 +75,128 @@ const PROTECTED_PATH_SEGMENTS = [
     "state/reports/",
 ];
 const PROTECTED_FILENAMES = ["agent.json", "tool-profiles.json"];
-/** The agent's psyche folder ships only from the repository (a pull request and the replay gate), so no tool writes into it. */
-function isPsychePath(filePath, agentRoot) {
-    if (!agentRoot || !filePath)
+/** How many symlinks a dangling-link walk follows before refusing (the Linux kernel's own limit is 40). */
+const MAX_SYMLINK_HOPS = 40;
+/** A lookup that failed only because part of the path does not exist yet; any other failure leaves the target unknown. */
+function rethrowUnlessMissing(error) {
+    const code = error.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR")
+        throw error;
+}
+/**
+ * The real location of `lexical`: `realpathSync.native` of the deepest part that exists, the final file included, with the
+ * missing remainder appended. A dangling symlink is followed, from its real parent, to where a write through it would land.
+ * Throws when the filesystem cannot say where the path lands (a denied lookup, a symlink loop, too many links), so the
+ * guard can refuse rather than fall back to the lexical path.
+ */
+function canonicalize(lexical) {
+    let current = lexical;
+    const missing = [];
+    let hops = 0;
+    for (;;) {
+        try {
+            return path.join(fs.realpathSync.native(current), ...missing);
+        }
+        catch (error) {
+            rethrowUnlessMissing(error);
+        }
+        let stat;
+        try {
+            stat = fs.lstatSync(current);
+        }
+        catch (error) {
+            rethrowUnlessMissing(error);
+        }
+        if (stat?.isSymbolicLink()) {
+            if (hops >= MAX_SYMLINK_HOPS)
+                throw new Error(`too many symbolic links resolving ${lexical}`);
+            hops += 1;
+            current = path.resolve(fs.realpathSync.native(path.dirname(current)), fs.readlinkSync(current));
+            continue;
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return path.join(current, ...missing);
+        missing.unshift(path.basename(current));
+        current = parent;
+    }
+}
+/**
+ * Every place a file tool could write `p`: resolved against the agent root and against the repo root (which is what
+ * `write_file` and `edit_file` use), each in its lexical and canonical form. An absolute `p` is resolved only as itself.
+ */
+function canonicalTarget(p, agentRoot) {
+    const lexicals = path.isAbsolute(p) ? [p] : [path.resolve(agentRoot, p), path.resolve((0, identity_1.getRepoRoot)(), p)];
+    return lexicals.flatMap((lexical) => [lexical, canonicalize(lexical)]);
+}
+/** True when any form of `p` is the agent's `folder` (in either its lexical or its canonical form) or under it. */
+function insideAgentFolder(p, agentRoot, folder) {
+    const lexicalFolder = path.resolve(agentRoot, folder);
+    const folders = [lexicalFolder, canonicalize(lexicalFolder)];
+    return canonicalTarget(p, agentRoot).some((target) => folders.some((dir) => target === dir || target.startsWith(`${dir}${path.sep}`)));
+}
+// --- the psyche belongs to the agent ---
+// Every agent writes its own TACIT.md: what it learns about how its house works. The rest of its psyche (who it is) changes only
+// when a family human asks it directly, one to one, on a channel that proves who they are.
+exports.PSYCHE_REFUSAL = "that file is part of me; I change it when my owner asks me in our own chat.";
+const PSYCHE_IDENTITY_CHANNELS = new Set(["telegram", "bluebubbles", "teams"]);
+/** `tacit` for the agent's psyche/TACIT.md, `identity` for anything else in psyche/ (the folder and new files included), `null` outside it. */
+function psycheFileClass(filePath, agentRoot) {
+    if (!filePath || !agentRoot || !insideAgentFolder(filePath, agentRoot, "psyche"))
+        return null;
+    const lexicalFolder = path.resolve(agentRoot, "psyche");
+    const folders = [lexicalFolder, canonicalize(lexicalFolder)];
+    const tacits = folders.map((folder) => path.join(folder, "TACIT.md"));
+    // Every form of the path that lands in psyche/ must be TACIT: a link that sends one form of it to SOUL makes it identity.
+    const inPsyche = canonicalTarget(filePath, agentRoot).filter((target) => folders.some((dir) => target === dir || target.startsWith(`${dir}${path.sep}`)));
+    return inPsyche.every((target) => tacits.includes(target)) ? "tacit" : "identity";
+}
+/** The lstat of `p`, or null when it does not exist; throws on any other lookup failure. */
+function lstatIfPresent(p) {
+    try {
+        return fs.lstatSync(p);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+/** Whether the person in this conversation may have the agent write this psyche file. */
+function psycheWriteAllowed(fileClass, _filePath, context) {
+    const agentRoot = context.agentRoot;
+    /* v8 ignore next -- a file is only classed as psyche when there is an agent root @preserve */
+    if (!agentRoot)
         return false;
+    try {
+        if (lstatIfPresent(path.join(agentRoot, "psyche"))?.isSymbolicLink())
+            return false;
+        if (fileClass === "tacit") {
+            // A symlink or a hard link would carry the write to some other file.
+            const tacit = lstatIfPresent(path.join(agentRoot, "psyche", "TACIT.md"));
+            if (tacit && (tacit.isSymbolicLink() || tacit.nlink > 1))
+                return false;
+            if (context.friendId === undefined)
+                return true;
+            return context.trustLevel === undefined || context.trustLevel === "friend" || context.trustLevel === "family";
+        }
+    }
+    catch {
+        return false;
+    }
+    return context.friendKind === "human"
+        && context.trustLevel === "family"
+        && context.channel !== undefined && PSYCHE_IDENTITY_CHANNELS.has(context.channel)
+        && context.isGroupChat !== true
+        // Teams does not yet tell the turn whether it is a group chat, so there only an explicit one-to-one counts.
+        && (context.channel !== "teams" || context.isGroupChat === false);
+}
+/** The line a successful write to an identity file carries back to the agent. */
+function psycheEditNote(file) {
+    return `psyche edit: I changed psyche/${file}. I tell my owner in one line which file changed and why.`;
+}
+/** The agent's psyche folder, in the lexical form the shell check uses; the file tools classify with `psycheFileClass`. */
+function isPsychePath(filePath, agentRoot) {
     const psyche = path.resolve(agentRoot, "psyche");
     const target = path.resolve(agentRoot, filePath);
     return target === psyche || target.startsWith(`${psyche}${path.sep}`);
@@ -85,8 +208,6 @@ function isPsychePath(filePath, agentRoot) {
  * only: a shell can still write anywhere its uid can, which is why delegated-command authority lives outside the bundle.
  */
 function isFriendsStorePath(filePath, agentRoot) {
-    if (!agentRoot || !filePath)
-        return false;
     const store = path.resolve(agentRoot, "friends");
     const target = path.resolve(agentRoot, filePath);
     return target === store || target.startsWith(`${store}${path.sep}`);
@@ -132,9 +253,9 @@ function shellWritesToProtectedPath(command) {
     return false;
 }
 // --- the psyche folder in shell commands ---
-// The psyche folder is mounted read-only into the resident at the OS level (the upgrade recreates the container that way). This is the
-// defence in depth in front of that: a shell command that mentions the psyche folder at all runs only if every part of it is
-// a read-only command, because enumerating the ways to write a file (>, >>, tee, cp, mv, sed -i, node -e, python, cd then
+// The agent changes its own psyche through write_file and edit_file, where the trust gate below decides who may ask for it.
+// The shell never writes there, for anyone: a shell command that mentions the psyche folder at all runs only if every part of
+// it is a read-only command, because enumerating the ways to write a file (>, >>, tee, cp, mv, sed -i, node -e, python, cd then
 // redirect) is a list the model can always step around.
 const PSYCHE_READ_ONLY_COMMANDS = new Set(["cat", "ls", "head", "tail", "grep", "wc", "sha256sum", "stat", "cd", "pwd"]);
 const SEGMENT_OPERATORS = new Set(["&&", "||", ";", "|"]);
@@ -177,7 +298,10 @@ function commandMentionsPsyche(command, words, agentRoot) {
     if (words.some((word) => word === "psyche" || isPsychePath(word, agentRoot)))
         return true;
     // A relative "psyche/..." inside code or a quoted argument, when this agent has such a folder.
-    return /(?:^|[\s'"=(])psyche\//.test(command) && fs.existsSync(psyche);
+    if (/(?:^|[\s'"=(])psyche\//.test(command) && fs.existsSync(psyche))
+        return true;
+    // ~/..., $HOME/... and paths relative to a cd or -C target that land in this agent's psyche/.
+    return commandMentionsAgentFolder(command, words, agentRoot, "psyche");
 }
 /**
  * The shared rule: when a shell command mentions a protected folder at all, it runs only if every part of it is a read-only
@@ -212,7 +336,13 @@ function protectedFolderShellWriteRefused(command, mentions) {
 function psycheShellWriteRefused(command, agentRoot) {
     if (!agentRoot)
         return false;
-    return protectedFolderShellWriteRefused(command, (words) => commandMentionsPsyche(command, words, agentRoot));
+    try {
+        return protectedFolderShellWriteRefused(command, (words) => commandMentionsPsyche(command, words, agentRoot));
+    }
+    catch {
+        // The filesystem could not say where a path that names psyche/ lands: refuse rather than guess.
+        return true;
+    }
 }
 // --- the friends store in shell commands ---
 // Same stance as the psyche folder: a command that names this agent's friends store runs only if it is read-only, because a list of
@@ -234,12 +364,83 @@ function commandMentionsFriendsStore(command, words, agentRoot) {
         return true;
     // An absolute or relative path inside code or a quoted argument, such as node -e "...'/bundle/friends/x.json'...".
     const store = path.resolve(agentRoot, "friends");
-    return command.includes(store) || /(?:^|[\s'"=(])friends\//.test(command);
+    if (command.includes(store) || /(?:^|[\s'"=(])friends\//.test(command))
+        return true;
+    // Paths relative to a cd or -C target that land in this agent's friends/.
+    return commandMentionsAgentFolder(command, words, agentRoot, "friends");
 }
 function friendsShellWriteRefused(command, agentRoot) {
     if (!agentRoot)
         return false;
-    return protectedFolderShellWriteRefused(command, (words) => commandMentionsFriendsStore(command, words, agentRoot));
+    try {
+        return protectedFolderShellWriteRefused(command, (words) => commandMentionsFriendsStore(command, words, agentRoot));
+    }
+    catch {
+        // The filesystem could not say where a path that names friends/ lands: refuse rather than guess.
+        return true;
+    }
+}
+// --- where a path in a shell command lands ---
+// A command can name one of this agent's folders by an absolute path, by ~/ or $HOME/, or relative to wherever it cd's (or
+// git -C's) first. Each word whose path has a part exactly `<name>` is resolved against every directory the command could be
+// working in, lexically and canonically, and counts when it lands in this agent's <name>/.
+const UNFOLLOWABLE_WORKING_DIRECTORY = /(?:^|[\s;&|(`])(?:pushd|popd)(?:\s|$)|(?:^|[\s;&|(`])cd\s+(?:--|["']?\$)|\s-C\s*["']?\$|(?:^|[\s;&|(`/])(?:sh|bash|zsh|dash|ksh)\s+(?:-\w+\s+)*-\w*c\b/;
+/** Words of a shell command that name a path whose part is exactly `name`, wherever they sit (code and quotes included). */
+function namedFolderWords(command, name) {
+    const part = new RegExp(`(?:^|/)${name}(?:/|$)`);
+    return command.split(/[\s'"=();|&<>`]+/).filter((token) => part.test(token));
+}
+function commandMentionsAgentFolder(command, words, agentRoot, name) {
+    const lexicalFolder = path.resolve(agentRoot, name);
+    if (globOrExpansionCouldReach(command, lexicalFolder, agentRoot))
+        return true;
+    const candidates = namedFolderWords(command, name);
+    if (candidates.length === 0)
+        return false;
+    // A variable in front of the path ($HOME/.../<name>/x): where it lands is the shell's to say, so it counts.
+    if (candidates.some((candidate) => candidate.includes("$")))
+        return true;
+    // A working directory this guard cannot follow (pushd, cd --, a cd or -C to a variable, or a nested shell's -c string):
+    // a relative path could land anywhere, so it counts.
+    if (UNFOLLOWABLE_WORKING_DIRECTORY.test(command))
+        return true;
+    // A path that names this bundle's own folder (x.ouro/psyche) or a glob just above the folder (*/psyche) is this agent's
+    // wherever the command works from, so eval, a piped shell, env --chdir, find -path and code that chdir's all count.
+    const bundle = path.basename(path.resolve(agentRoot)).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const anchored = new RegExp(`(?:^|/)(?:${bundle}|[^/]*[*?[][^/]*)/${name}(?:/|$)`);
+    if (candidates.some((candidate) => anchored.test(candidate)))
+        return true;
+    const folders = [lexicalFolder, path.join(canonicalize(path.resolve(agentRoot)), name)];
+    // Every directory the command could be working in: where the shell starts, and each cd target, from each earlier one.
+    const cwds = [process.cwd()];
+    for (const [index, word] of words.entries()) {
+        // `git -C <dir>` works in <dir> just as `cd <dir>` does.
+        if (words[index - 1] !== "cd" && words[index - 1] !== "-C")
+            continue;
+        const target = expandHome(word);
+        cwds.push(...(path.isAbsolute(target) ? [target] : cwds.map((cwd) => path.resolve(cwd, target))));
+    }
+    return candidates.some((candidate) => {
+        const word = expandHome(candidate);
+        const lexicals = path.isAbsolute(word) ? [path.resolve(word)] : cwds.map((cwd) => path.resolve(cwd, word));
+        return lexicals.flatMap((lexical) => [lexical, canonicalize(lexical)])
+            .some((target) => folders.some((dir) => target === dir || target.startsWith(`${dir}${path.sep}`)));
+    });
+}
+// --- the product rules in shell commands ---
+// product/PRODUCT.md is the package's standing rules for this agent; releases replace it, and nothing in a conversation does.
+// Unlike the friends store, a bare relative "product/" is an ordinary project folder almost everywhere, so it counts as this
+// agent's only when the command is plainly working in the agent root.
+function productShellWriteRefused(command, agentRoot) {
+    if (!agentRoot)
+        return false;
+    try {
+        return protectedFolderShellWriteRefused(command, (words) => commandMentionsAgentFolder(command, words, agentRoot, "product"));
+    }
+    catch {
+        // The filesystem could not say where a path that names product/ lands: refuse rather than guess.
+        return true;
+    }
 }
 // --- structural guardrail checks (always on, all trust levels) ---
 function checkReadBeforeWrite(toolName, args, context) {
@@ -272,17 +473,37 @@ function checkDestructiveShellPatterns(toolName, args) {
 function checkProtectedPaths(toolName, args, context) {
     if (toolName === "write_file" || toolName === "edit_file") {
         const filePath = args.path || "";
-        if (isPsychePath(filePath, context.agentRoot))
-            return deny(REASONS.psychePath);
-        if (isProtectedPath(filePath) || isFriendsStorePath(filePath, context.agentRoot))
+        // The file tools resolve a relative path against the repo root and follow symlinks, so the guard checks every form.
+        // A path whose landing place the filesystem cannot report is refused rather than checked lexically.
+        const agentRoot = filePath ? context.agentRoot : undefined;
+        if (agentRoot) {
+            try {
+                const psycheClass = psycheFileClass(filePath, agentRoot);
+                if (psycheClass && !psycheWriteAllowed(psycheClass, filePath, context))
+                    return deny(exports.PSYCHE_REFUSAL);
+                if (insideAgentFolder(filePath, agentRoot, "friends"))
+                    return deny(REASONS.protectedPath);
+                if (insideAgentFolder(filePath, agentRoot, "product"))
+                    return deny(REASONS.protectedPath);
+                // A link can carry a write that reads as harmless to a protected file (state/policy, agent.json).
+                if (canonicalTarget(filePath, agentRoot).some(isProtectedPath))
+                    return deny(REASONS.protectedPath);
+            }
+            catch {
+                return deny(REASONS.protectedPath);
+            }
+        }
+        if (isProtectedPath(filePath))
             return deny(REASONS.protectedPath);
     }
     if (toolName === "shell") {
         const command = args.command || "";
         if (psycheShellWriteRefused(command, context.agentRoot))
-            return deny(REASONS.psychePath);
+            return deny(exports.PSYCHE_REFUSAL);
         if (friendsShellWriteRefused(command, context.agentRoot))
             return deny(REASONS.protectedPath);
+        if (productShellWriteRefused(command, context.agentRoot))
+            return deny(REASONS.protectedPath);
         if (shellWritesToProtectedPath(command))
             return deny(REASONS.protectedPath);
     }

package/dist/repertoire/tools-escalation.js

@@ -50,13 +50,13 @@ exports.reportFailureToolDefinition = {
         type: "function",
         function: {
             name: "report_failure",
-            description: "File a failure report for the engineers who fix you. Use it when a tool you need is missing, a tool errors in a way you cannot work around, or you are about to give up on what the owner asked. When the owner asks for something you cannot do (for example, setting a thermostat you have no tool for), file it right away and then tell him it is filed, with the short report id, in your own words. Do not ask his permission before filing, and do not ask him to do anything about it.",
+            description: "File a failure report for the engineers who fix you. Use it when a tool you need is missing or a tool errors in a way you cannot work around, so the engineers can get the owner's request moving. When the owner asks for something you have no tool for yet (for example, setting a thermostat), file it right away so the engineers can add it, and then tell him it is filed, with the short report id, in your own words. File it at once and ask him for nothing.",
             parameters: {
                 type: "object",
                 properties: {
                     ari_words: { type: "string", description: "What the owner asked for, verbatim from the conversation." },
                     tried: { type: "string", description: "What you tried: tool names and arguments, summarized." },
-                    error: { type: "string", description: "The tool error, or the reason you gave up." },
+                    error: { type: "string", description: "The tool error, or what stopped you." },
                     failed_tool: { type: "string", description: "The tool that failed or that you wished existed, if there is one." },
                     severity: { type: "string", enum: ["low", "medium", "high"], description: "How much this blocks the owner." },
                 },

package/dist/repertoire/tools-files.js

@@ -41,6 +41,22 @@ const identity_1 = require("../heart/identity");
 const file_state_1 = require("../mind/file-state");
 const scrutiny_1 = require("../mind/scrutiny");
 const tools_base_1 = require("./tools-base");
+const guardrails_1 = require("./guardrails");
+/** The psyche edit note for a write that landed on one of the agent's identity files, or "" for any other file. */
+function psycheNoteFor(resolvedPath, ctx) {
+    try {
+        const agentRoot = ctx?.agentRoot ?? (0, identity_1.getAgentRoot)();
+        if ((0, guardrails_1.psycheFileClass)(resolvedPath, agentRoot) !== "identity")
+            return "";
+        // The note names the file that actually changed, even when the write went through a link.
+        const relative = path.relative(fs.realpathSync.native(path.resolve(agentRoot, "psyche")), fs.realpathSync.native(resolvedPath));
+        return `\n\n${(0, guardrails_1.psycheEditNote)(relative.split(path.sep).join("/"))}`;
+    }
+    catch {
+        /* v8 ignore next -- defensive: the write already succeeded, so a failed lookup only drops the note @preserve */
+        return "";
+    }
+}
 function resolveLocalToolPath(targetPath) {
     if (!path.isAbsolute(targetPath)) {
         return path.resolve((0, identity_1.getRepoRoot)(), targetPath);
@@ -115,14 +131,15 @@ exports.fileToolDefinitions = [
                 },
             },
         },
-        handler: (a) => {
+        handler: (a, ctx) => {
             const resolvedPath = resolveLocalToolPath(a.path);
             fs.mkdirSync(path.dirname(resolvedPath), { recursive: true });
             fs.writeFileSync(resolvedPath, a.content, "utf-8");
             (0, scrutiny_1.trackModifiedFile)(resolvedPath);
             const scrutiny = (0, scrutiny_1.getPostImplementationScrutiny)((0, scrutiny_1.getModifiedFileCount)());
+            const note = psycheNoteFor(resolvedPath, ctx);
             /* v8 ignore next -- scrutiny appendix branch depends on session-level file count @preserve */
-            return scrutiny ? `ok\n\n${scrutiny}` : "ok";
+            return (scrutiny ? `ok\n\n${scrutiny}` : "ok") + note;
         },
         summaryKeys: ["path"],
         riskProfile: { mutates: "durable_state_write", risk: "high", reason: "writes file contents" },
@@ -144,7 +161,7 @@ exports.fileToolDefinitions = [
                 },
             },
         },
-        handler: (a) => {
+        handler: (a, ctx) => {
             const resolvedPath = resolveLocalToolPath(a.path);
             if (!tools_base_1.editFileReadTracker.has(resolvedPath)) {
                 return `error: you must read the file with read_file before editing it. call read_file on ${a.path} first.`;
@@ -193,6 +210,7 @@ exports.fileToolDefinitions = [
             const newStringLines = a.new_string.split("\n");
             const changeEndLine = changeStartLine + newStringLines.length;
             const diffResult = buildContextDiff(lines, changeStartLine, changeEndLine);
+            const note = psycheNoteFor(resolvedPath, ctx);
             // Track modified file and compute scrutiny appendix
             (0, scrutiny_1.trackModifiedFile)(resolvedPath);
             const scrutiny = (0, scrutiny_1.getPostImplementationScrutiny)((0, scrutiny_1.getModifiedFileCount)());
@@ -200,11 +218,11 @@ exports.fileToolDefinitions = [
             /* v8 ignore start -- staleness+diff+scrutiny combo not exercised in integration tests @preserve */
             if (stalenessCheck.stale) {
                 const base = `${diffResult}\n\n⚠️ warning: file changed externally since last read -- re-read recommended`;
-                return scrutiny ? `${base}\n\n${scrutiny}` : base;
+                return (scrutiny ? `${base}\n\n${scrutiny}` : base) + note;
             }
             /* v8 ignore stop */
             /* v8 ignore next -- scrutiny appendix branch depends on session-level file count @preserve */
-            return scrutiny ? `${diffResult}\n\n${scrutiny}` : diffResult;
+            return (scrutiny ? `${diffResult}\n\n${scrutiny}` : diffResult) + note;
         },
         summaryKeys: ["path"],
         riskProfile: { mutates: "durable_state_write", risk: "high", reason: "edits file contents" },

package/dist/repertoire/tools-notes.js

@@ -57,13 +57,13 @@ function bundleRelativeLocator(filePath, ctx) {
     return filePath.split(path.sep).join("/");
 }
 // A friend note is a fact or preference about a person. The agent's own personality, voice and psyche are not facts
-// about the person: they live in the bundle's psyche folder, which ships from the repo and is changed by pull request.
+// about the person: they live in the bundle's psyche folder, which the agent itself keeps.
 const OWN_PERSONA_NOTE = /\b(?:your|my|the\s+(?:agent|butler|bot|assistant)(?:['\u2019]s)?)\s+(?:own\s+)?(?:personality|persona|psyche|soul|identity|character|voice|self[- ]concept)\b|\b(?:channel|embody|role-?play|act\s+like|talk\s+like|sound\s+like|be\s+more)\b[^.\n]{0,40}\b(?:energy|vibe|character|persona)\b|\b(?:act|behave)\s+like\s+(?:a|an|the)\b/i;
 const PERSONA_KEY = /^\s*(?:persona|personality|psyche|soul)\s*$/i;
 function isOwnPersonaNote(key, content) {
     return PERSONA_KEY.test(key ?? "") || OWN_PERSONA_NOTE.test(`${key ?? ""} ${content ?? ""}`);
 }
-exports.OWN_PERSONA_NOTE_REFUSAL = "that note is about my own personality or voice, not about the person, so it does not belong in a friend note. my psyche lives in the bundle's psyche folder and ships from the repo; i do not edit it live. a personality change goes to Claude Code as a request (over A2A, or as a failure or feature report), and it ships by pull request through the replay gate. this is a guardrail on persona content, not on the person: a note about the person themselves (their facts, preferences, voice, character in a game) is fine and saves normally. friend notes hold facts and preferences about this person only.";
+exports.OWN_PERSONA_NOTE_REFUSAL = "that note is about my own personality or voice, not about this person, so it belongs in my psyche, not in a friend note. what i learn about how the house works goes into psyche/TACIT.md, and the rest of my psyche changes when my owner asks me directly. a note about the person themselves (their facts, preferences, voice, a character in a game) saves normally.";
 exports.notesToolDefinitions = [
     {
         tool: {

package/dist/repertoire/tools-unraid.js

@@ -446,7 +446,7 @@ exports.unraidToolDefinitions = [
     readDefinition("unraid_check_services", "Freshly check the fixed public Sanctuary service endpoints and return bounded status with an observation timestamp.", "checkServices"),
     readDefinition("sanctuary_get_download_queue", "Read the bounded live usenet (SABnzbd) download queue state only, including whether the spend guard has paused it. It cannot see torrents or Sonarr/Radarr progress: an idle result here does not mean a download is absent. For a series or movie download, including torrents, use media_queue.", "getDownloadQueue"),
     {
-        tool: { type: "function", function: { name: "sanctuary_resume_download_queue", description: "Resume the household download queue after the owner confirms the provider is ready, then independently verify paused=false. This can spend prepaid download credit.", parameters: emptyParameters } },
+        tool: { type: "function", function: { name: "sanctuary_resume_download_queue", description: "Resume the household download queue, then independently verify paused=false.", parameters: emptyParameters } },
         handler: async (_args, ctx) => JSON.stringify(ctx?.sanctuary ? await ctx.sanctuary.resumeDownloadQueue() : JSON.parse(missingRuntime())),
         riskProfile: { mutates: "external_side_effect", risk: "high", reason: "resumes downloads that can spend prepaid provider credit" },
         approvalPolicy: () => ({ kind: "required", policyId: "sanctuary.downloads.resume.v1", actionClass: "sanctuary.downloads.resume", requiresSoleCall: true }),

package/dist/repertoire/tools.js

@@ -433,6 +433,7 @@ async function preflightToolCall(name, args, ctx) {
         const guardContext = {
             readPaths: tools_base_1.editFileReadTracker, trustLevel: ctx?.context?.friend?.trustLevel,
             agentRoot: ctx?.agentRoot ?? safeGetAgentRoot(), friendId: ctx?.context?.friend?.id,
+            friendKind: ctx?.context?.friend?.kind, channel: ctx?.context?.channel?.channel,
             ...(def?.mcpServer ? { mcpServerName: def.mcpServer } : {}),
             ...(typeof group === "boolean" ? { isGroupChat: group } : {}),
         };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.981",
+  "version": "0.1.0-alpha.983",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.981",
+      "version": "0.1.0-alpha.983",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.981",
+  "version": "0.1.0-alpha.983",
   "engines": {
     "node": ">=22"
   },