@ouro.bot/cli 0.1.0-alpha.990 → 0.1.0-alpha.992

package/deploy/unraid/sanctuary.ouro/agent.json

@@ -61,6 +61,7 @@
     }
   },
   "sync": {
-    "enabled": false
+    "enabled": true,
+    "branch": "main"
   }
 }

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.990",
+  "runtimeVersion": "0.1.0-alpha.992",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.ouro/tool-profiles.json

@@ -2,7 +2,7 @@
   "version": 2,
   "profiles": {
     "sanctuary-owner": {
-      "version": 17,
+      "version": 18,
       "contextScopes": [
         "household.status",
         "household.policy",
@@ -38,6 +38,8 @@
         "steward_policy_manage",
         "house_sweep",
         "house_digest_send",
+        "bundle_push",
+        "bundle_pull_rebase",
         "send_message",
         "ponder",
         "rest",

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.990</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.992</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>
@@ -26,4 +26,5 @@
   <Config Name="Privileged event spool" Target="/run/ouro-events" Default="/boot/config/custom/ouro-events/spool" Mode="ro" Description="Root-owned detector envelopes, read-only inside the Butler" Type="Path" Display="always" Required="true" Mask="false">/boot/config/custom/ouro-events/spool</Config>
   <Config Name="Root authority socket" Target="/run/ouro-authority" Default="/run/ouro-authority" Mode="ro" Description="Root-owned gateway socket and public issuer pins only" Type="Path" Display="always" Required="true" Mask="false">/run/ouro-authority</Config>
   <Config Name="Operator trust (read-only)" Target="/etc/ouro/trust/sanctuary" Default="/mnt/user/appdata/ouro-butler/trust/sanctuary" Mode="ro" Description="Root-owned grants the Butler honours (delegated commands, escalation). Read-only inside the Butler; only the host operator can change it" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/ouro-butler/trust/sanctuary</Config>
+  <Config Name="Bundle sync key (read-only)" Target="/run/ouro-sync" Default="/mnt/user/appdata/ouro-butler/sync" Mode="ro" Description="Deploy key the Butler's bundle sync pushes with, owned by 10002:10002 mode 0400 so only the sync wrapper reads it. Read-only inside the Butler" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/ouro-butler/sync</Config>
 </Container>

package/dist/heart/config.js

@@ -342,11 +342,12 @@ function getSyncConfig() {
         return {
             enabled: agentConfig.sync?.enabled ?? false,
             remote: agentConfig.sync?.remote ?? "origin",
+            branch: agentConfig.sync?.branch ?? "main",
         };
     }
     catch {
         /* v8 ignore next -- defensive: loadAgentConfig failure in test/bootstrap @preserve */
-        return { enabled: false, remote: "origin" };
+        return { enabled: false, remote: "origin", branch: "main" };
     }
 }
 function getOpenAIEmbeddingsApiKey() {

package/dist/heart/daemon/agent-discovery.js

@@ -315,6 +315,7 @@ function listBundleSyncRows(options = {}) {
         const configPath = path.join(bundleRoot, "agent.json");
         let enabled = false;
         let remote = "origin";
+        let branch = "main";
         try {
             const raw = readFileSync(configPath, "utf-8");
             const parsed = JSON.parse(raw);
@@ -324,12 +325,15 @@ function listBundleSyncRows(options = {}) {
                 if (typeof parsed.sync.remote === "string" && parsed.sync.remote.length > 0) {
                     remote = parsed.sync.remote;
                 }
+                if (typeof parsed.sync.branch === "string" && parsed.sync.branch.length > 0) {
+                    branch = parsed.sync.branch;
+                }
             }
         }
         catch {
             // Best-effort: bundle without readable config still gets a row with defaults
         }
-        const row = { agent, enabled, remote };
+        const row = { agent, enabled, remote, branch };
         if (enabled) {
             // Only meaningful when sync is enabled — we don't care about disabled bundles'
             // git state. Check .git presence before attempting any git invocation.

package/dist/heart/daemon/agent-home.js

@@ -8,12 +8,14 @@
  * module writes it (`ouro move <agent> here`) and checks a running daemon
  * against it.
  *
- * A move is a compare-and-swap on the bundle's remote. It starts only from a
- * bundle that is exactly at its upstream (nothing unpushed, agent.json clean),
- * commits only agent.json and pushes. A fast-forward push succeeds only if
- * nobody pushed in between. When the push is rejected, the move is undone; if
- * the upstream lease changed meanwhile, another machine won and the move
- * stops, otherwise it is retried once on the new upstream.
+ * A move is a compare-and-swap on the bundle's remote. It runs under the
+ * bundle sync lock, honours a sync pause, and names `<remote>` and
+ * `sync.branch` explicitly (never `@{u}`). It starts only from a bundle that
+ * is exactly at `<remote>/<branch>` (nothing unpushed, agent.json clean),
+ * commits only agent.json and pushes `HEAD:<branch>`. A fast-forward push
+ * succeeds only if nobody pushed in between. When the push is refused, the
+ * move is undone; if the remote's lease changed meanwhile, another machine won
+ * and the move stops, otherwise it is retried once on the new remote state.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -57,13 +59,20 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const runtime_1 = require("../../nerves/runtime");
+const sync_1 = require("../sync");
 const agent_discovery_1 = require("./agent-discovery");
+const SYNC_NETWORK = {
+    fetch: (agentRoot, config) => (0, sync_1.fetchRemote)(agentRoot, config),
+    push: (agentRoot, config) => (0, sync_1.pushHeadToBranch)(agentRoot, config),
+};
 const MOVE_ATTEMPTS = 2;
+const MOVE_LOCK_WAIT_MS = 10_000;
 function readSyncSettings(parsed) {
     const sync = parsed.sync;
     return {
         enabled: sync?.enabled === true,
         remote: typeof sync?.remote === "string" && sync.remote.trim() ? sync.remote : "origin",
+        branch: typeof sync?.branch === "string" && sync.branch.trim() ? sync.branch : "main",
     };
 }
 function errorText(error) {
@@ -87,11 +96,12 @@ function recordedPushError(agentRoot) {
     }
 }
 /** Record this machine as the agent's home in its synced agent.json. */
-function moveAgentHomeHere(options) {
+async function moveAgentHomeHere(options) {
     const { agent, machineId, machineName } = options;
     const agentRoot = path.join(options.bundlesRoot, `${agent}.ouro`);
     const configPath = path.join(agentRoot, "agent.json");
     const git = options.execFileSync ?? child_process_1.execFileSync;
+    const network = options.network ?? SYNC_NETWORK;
     const now = options.now ?? (() => new Date());
     const run = (args) => git("git", args, { cwd: agentRoot, stdio: "pipe", timeout: 30_000 }).toString().trim();
     (0, runtime_1.emitNervesEvent)({
@@ -140,35 +150,47 @@ function moveAgentHomeHere(options) {
         const why = sync.enabled ? "the bundle is not a git repo" : "bundle sync is off";
         return finish({ ok: true, changed: true, message: `${movedMessage(current)}; ${why}, so only this machine sees the change` });
     }
+    const pausedRefusal = (until) => refuse(`${agent}'s bundle sync is paused until ${until}, so nothing changed; run \`ouro move ${agent} here\` again after that`);
+    const pausedUntil = (0, sync_1.syncPausedUntil)(agentRoot);
+    if (pausedUntil !== null)
+        return pausedRefusal(pausedUntil);
+    const lock = await (0, sync_1.holdSyncLock)(agentRoot, options.lockWaitMs ?? MOVE_LOCK_WAIT_MS);
+    if ("busy" in lock) {
+        return refuse(`another bundle sync holds ${agent}'s lock${lock.holderPid === null ? "" : ` (pid ${lock.holderPid})`}, so nothing changed; try again in a moment`);
+    }
     try {
+        // A pause can begin while this move waited for the lock (the replay gate
+        // pauses, then takes the lock), so look again now that the lock is ours.
+        const pausedNow = (0, sync_1.syncPausedUntil)(agentRoot);
+        if (pausedNow !== null)
+            return pausedRefusal(pausedNow);
         if (run(["status", "--porcelain", "--", "agent.json"]).length > 0) {
             return refuse(`${agent}'s agent.json has uncommitted changes, so nothing changed; commit or discard them first (git -C ${agentRoot} diff agent.json)`);
         }
         const hasRemote = run(["remote"]).split("\n").includes(sync.remote);
+        const tracking = (0, sync_1.syncTrackingRef)(sync);
         let seen = null;
         let lastPushError = "";
         for (let attempt = 1; attempt <= MOVE_ATTEMPTS; attempt++) {
             if (hasRemote) {
-                try {
-                    run(["fetch", "-q", sync.remote]);
-                }
-                catch (error) {
-                    return refuse(`could not reach ${agent}'s bundle remote, so nothing changed: ${errorText(error)}`);
+                const fetched = await network.fetch(agentRoot, sync);
+                if (!fetched.ok) {
+                    return refuse(`could not reach ${agent}'s bundle remote, so nothing changed: ${fetched.error}`);
                 }
-                let unpushed;
                 try {
-                    unpushed = Number(run(["rev-list", "--count", "@{u}..HEAD"]));
+                    run(["rev-parse", "--verify", "-q", tracking]);
                 }
-                catch (error) {
-                    return refuse(`${agent}'s bundle branch has no upstream to publish the move to, so nothing changed: ${errorText(error)}`);
+                catch {
+                    return refuse(`${agent}'s bundle remote has no ${sync.branch} branch to publish the move to, so nothing changed`);
                 }
+                const unpushed = Number(run(["rev-list", "--count", `${tracking}..HEAD`]));
                 if (unpushed > 0) {
                     const recorded = recordedPushError(agentRoot);
-                    const why = recorded ? `the last bundle push failed with: ${recorded}` : `run \`git -C ${agentRoot} push\` to see why they did not publish`;
+                    const why = recorded ? `the last bundle push failed with: ${recorded}` : `run \`ouro sync --agent ${agent}\` to see why they did not publish`;
                     return refuse(`${agent}'s bundle has ${unpushed} unpushed commit${unpushed === 1 ? "" : "s"}, so nothing changed; fix bundle sync first, because a move must not publish them as a side effect (${why})`);
                 }
                 try {
-                    run(["merge", "--ff-only", "-q", "@{u}"]);
+                    run(["merge", "--ff-only", "-q", tracking]);
                 }
                 catch (error) {
                     return refuse(`could not bring ${agent}'s bundle up to date with its remote, so nothing changed: ${errorText(error)}`);
@@ -188,7 +210,7 @@ function moveAgentHomeHere(options) {
             }
             writeHome(config.parsed, current);
             try {
-                run(["commit", "-q", "-m", `home: ${agent} moves to ${machineName}`, "--", "agent.json"]);
+                run(["-c", `user.name=${agent}`, "-c", `user.email=${agent}@ouro.local`, "commit", "-q", "-m", `home: ${agent} moves to ${machineName}`, "--", "agent.json"]);
             }
             catch (error) {
                 fs.writeFileSync(configPath, config.text, "utf-8");
@@ -197,13 +219,10 @@ function moveAgentHomeHere(options) {
             if (!hasRemote) {
                 return finish({ ok: true, changed: true, message: `${movedMessage(current)}; the bundle has no remote, so only this machine sees the change` });
             }
-            try {
-                run(["push", "-q", sync.remote]);
+            const pushed = await network.push(agentRoot, sync);
+            if (pushed.ok)
                 return finish({ ok: true, changed: true, message: movedMessage(current) });
-            }
-            catch (error) {
-                lastPushError = errorText(error);
-            }
+            lastPushError = pushed.error ?? "push failed";
             // Undo exactly our own commit; the working tree goes back to the
             // pre-move agent.json. If even that fails, say what to run by hand.
             try {
@@ -220,6 +239,9 @@ function moveAgentHomeHere(options) {
     catch (error) {
         return refuse(`could not move ${agent}, so nothing changed: ${errorText(error)}`);
     }
+    finally {
+        lock.release();
+    }
 }
 function execGit(cwd, args) {
     return new Promise((resolve, reject) => {
@@ -232,18 +254,32 @@ function execGit(cwd, args) {
     });
 }
 /**
- * Fetch the bundle's remote (without touching the working tree) and read the
- * lease in the upstream agent.json, so a machine notices a move away from it
- * even while the agent is idle and never pulls.
+ * Fetch `<remote>/<sync.branch>` (without touching the working tree) and read
+ * the lease in the remote's agent.json, so a machine notices a move away from
+ * it even while the agent is idle and never pulls. Fetch only, under the sync
+ * lock without waiting: a busy lock or a sync pause skips this check (unknown).
+ * It never commits or pushes.
  */
 async function readUpstreamAgentHome(agentRoot, git = execGit) {
     try {
         const sync = readSyncSettings(JSON.parse(fs.readFileSync(path.join(agentRoot, "agent.json"), "utf-8")));
         if (!sync.enabled || !fs.existsSync(path.join(agentRoot, ".git")))
             return undefined;
-        await git(agentRoot, ["fetch", "-q", sync.remote]);
-        const upstream = JSON.parse(await git(agentRoot, ["show", "@{u}:agent.json"]));
-        return (0, agent_discovery_1.parseAgentHome)(upstream.home);
+        if ((0, sync_1.syncPausedUntil)(agentRoot) !== null)
+            return undefined;
+        const lock = await (0, sync_1.holdSyncLock)(agentRoot, 0);
+        if ("busy" in lock)
+            return undefined;
+        try {
+            const fetched = await (0, sync_1.fetchRemote)(agentRoot, sync);
+            if (!fetched.ok)
+                return undefined;
+            const upstream = JSON.parse(await git(agentRoot, ["show", `${(0, sync_1.syncTrackingRef)(sync)}:agent.json`]));
+            return (0, agent_discovery_1.parseAgentHome)(upstream.home);
+        }
+        finally {
+            lock.release();
+        }
     }
     catch {
         return undefined;

package/dist/heart/daemon/boot-sync-probe.js

@@ -2,10 +2,11 @@
 /**
  * Boot sync probe — Layer 2 orchestrator for `ouro up`.
  *
- * For each sync-enabled bundle, runs `preTurnPullAsync` wrapped in
- * `runWithTimeouts`, classifies failures via `classifySyncFailure`, and
- * returns aggregated findings. Findings surface in the boot stdout
- * summary written by `cli-exec.ts` after the probe phase.
+ * For each sync-enabled bundle, runs `probeSync` (fetch only, then count
+ * commits ahead and behind) wrapped in `runWithTimeouts`, classifies failures
+ * via `classifySyncFailure`, and returns aggregated findings plus one status
+ * per probed bundle. Both surface in the boot stdout summary written by
+ * `cli-exec.ts` after the probe phase.
  *
  * Layer 2 is intentionally a **boot-time preflight surface only** — it
  * does NOT feed into the running daemon's rollup state. `computeDaemonRollup`
@@ -15,6 +16,8 @@
  * dispatches the right diagnostic skill).
  *
  * The probe NEVER:
+ *   - Merges, commits or pushes: it fetches only.
+ *   - Waits for the bundle sync lock: a held lock is reported as busy.
  *   - Writes to `state/` (verified by Unit 7's grep gate).
  *   - Throws — every failure becomes a finding.
  *   - Hangs — `AbortSignal` from `runWithTimeouts` cuts hung remotes
@@ -76,6 +79,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runBootSyncProbe = runBootSyncProbe;
 const path = __importStar(require("path"));
 const sync_1 = require("../sync");
+const sync_lock_1 = require("../sync-lock");
 const sync_classification_1 = require("../sync-classification");
 const timeouts_1 = require("../timeouts");
 const runtime_1 = require("../../nerves/runtime");
@@ -110,6 +114,7 @@ async function runBootSyncProbe(bundles, options) {
         meta: { bundleCount: bundles.length, softMs, hardMs },
     });
     const findings = [];
+    const statuses = [];
     for (const bundle of bundles) {
         if (!bundle.enabled)
             continue;
@@ -120,17 +125,24 @@ async function runBootSyncProbe(bundles, options) {
             findings.push({
                 agent: bundle.agent,
                 classification: "unknown",
-                error: `bundle is not a git repo; run \`git init\` inside ${agentRoot} to enable sync (or disable sync in agent.json)`,
+                error: sync_1.NOT_A_REPO_ERROR,
                 conflictFiles: [],
                 warnings: [],
                 advisory: true,
             });
             continue;
         }
-        const syncConfig = { enabled: bundle.enabled, remote: bundle.remote };
-        const outcome = await (0, timeouts_1.runWithTimeouts)((signal) => (0, sync_1.preTurnPullAsync)(agentRoot, syncConfig, { signal }), { softMs, hardMs, label: `boot-sync-probe ${bundle.agent}`, envKey: "GIT" });
+        const syncConfig = { enabled: bundle.enabled, remote: bundle.remote, branch: bundle.branch };
+        // A lock this pid left in an earlier life (PID 1 in the container) would read as busy forever.
+        try {
+            (0, sync_lock_1.clearOwnStaleSyncLock)(agentRoot);
+        }
+        catch {
+            // An unreadable lock is reported by the probe's own attempt below.
+        }
+        const outcome = await (0, timeouts_1.runWithTimeouts)((signal) => (0, sync_1.probeSync)(agentRoot, syncConfig, signal), { softMs, hardMs, label: `boot-sync-probe ${bundle.agent}`, envKey: "GIT" });
         // Hard timeout — the probe was aborted. Synthesise a finding from the
-        // outcome's classification (the underlying `preTurnPullAsync` may also
+        // outcome's classification (the underlying `probeSync` may also
         // have rejected with an AbortError, but the wrapper already swallowed
         // it).
         if (outcome.classification === "timeout-hard") {
@@ -170,6 +182,9 @@ async function runBootSyncProbe(bundles, options) {
             });
             continue;
         }
+        const status = describeProbeResult(result, syncConfig);
+        if (status)
+            statuses.push({ agent: bundle.agent, text: status });
         // Probe succeeded. If the soft warning fired, surface it as an advisory
         // finding so the operator sees the slow-pull warning even on success.
         if (outcome.warnings.length > 0) {
@@ -186,12 +201,23 @@ async function runBootSyncProbe(bundles, options) {
     // Stable order — sort by agent name so renderers and tests see the same
     // sequence.
     findings.sort((a, b) => a.agent.localeCompare(b.agent));
+    statuses.sort((a, b) => a.agent.localeCompare(b.agent));
     const durationMs = Date.now() - startedAt;
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.boot_sync_probe_end",
         message: "boot sync probe complete",
-        meta: { findingCount: findings.length, durationMs },
+        meta: { findingCount: findings.length, statusCount: statuses.length, durationMs },
     });
-    return { findings, durationMs };
+    return { findings, statuses, durationMs };
+}
+/** The probe's view of one healthy bundle, or null when there is nothing to say (no remote). */
+function describeProbeResult(result, config) {
+    if (result.paused)
+        return `sync paused until ${result.pausedUntil}`;
+    if (result.busy)
+        return `sync busy: another sync holds the lock${result.holderPid == null ? "" : ` (pid ${result.holderPid})`}`;
+    if (result.ahead === undefined || result.behind === undefined)
+        return null;
+    return `${result.ahead} ahead, ${result.behind} behind ${config.remote}/${config.branch}`;
 }