@ouro.bot/cli 0.1.0-alpha.990 → 0.1.0-alpha.992

package/dist/mind/prompt.js

@@ -65,6 +65,7 @@ const house_names_1 = require("./house-names");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
 const core_1 = require("../heart/core");
 const ouro_version_manager_1 = require("../heart/versioning/ouro-version-manager");
 const tools_1 = require("../repertoire/tools");
@@ -76,6 +77,7 @@ const runtime_credentials_1 = require("../heart/runtime-credentials");
 const runtime_mode_1 = require("../heart/daemon/runtime-mode");
 const friends_1 = require("@ouro.bot/friends");
 const runtime_1 = require("../nerves/runtime");
+const sync_1 = require("../heart/sync");
 const relationship_authorization_1 = require("../repertoire/relationship-authorization");
 const bundle_manifest_1 = require("./bundle-manifest");
 const first_impressions_1 = require("./first-impressions");
@@ -112,16 +114,91 @@ const PSYCHE_SOURCE_FILES = {
     product: ["product", "PRODUCT.md"],
     houseNames: ["house", "house.json"],
 };
-/** Every file the psyche is built from, read once; null when a file is absent or unreadable. */
+/** A conflict marker: a line starting `<<<<<<< ` with a later line starting `>>>>>>> `. A lone `=======` is valid text. */
+function hasConflictMarkers(text) {
+    const lines = text.split("\n");
+    const open = lines.findIndex((line) => line.startsWith("<<<<<<< "));
+    return open !== -1 && lines.slice(open + 1).some((line) => line.startsWith(">>>>>>> "));
+}
+// The last text of each file (by absolute path) that was read without conflict markers.
+const _lastGoodText = new Map();
+// Marker problems already reported, by path and content hash.
+const _reportedMarkers = new Set();
+// The outcome of the git fallback for a marked file, by path, valid while the file's marked content is unchanged.
+const _gitFallback = new Map();
+/** The committed copy of a bundle file, or null for a non-git bundle or a path git does not have. */
+function committedText(agentRoot, parts) {
+    const env = { ...process.env, LC_ALL: "C" };
+    for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE"])
+        delete env[name];
+    try {
+        return (0, child_process_1.execFileSync)("git", ["-c", "core.hooksPath=/dev/null", "show", `HEAD:./${parts.join("/")}`], {
+            cwd: agentRoot,
+            env,
+            maxBuffer: 16 * 1024 * 1024,
+            encoding: "utf-8",
+            timeout: 5_000,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+    }
+    catch {
+        return null;
+    }
+}
+function reportConflictMarkers(agentRoot, filePath, parts, text) {
+    const reportKey = `${filePath}:${(0, crypto_1.createHash)("sha256").update(text).digest("hex")}`;
+    if (_reportedMarkers.has(reportKey))
+        return;
+    _reportedMarkers.add(reportKey);
+    const relative = parts.join("/");
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        component: "mind",
+        event: "psyche.conflict_markers",
+        message: "psyche file has unresolved merge conflict markers; keeping it out of the prompt",
+        meta: { path: filePath },
+    });
+    (0, sync_1.tellOwner)(agentRoot, (0, sync_1.agentNameFromRoot)(agentRoot), {
+        noticeId: `psyche-conflict-markers:${reportKey}`,
+        text: `${relative} has unresolved merge conflict markers.`,
+    });
+}
+/** A file's text; text with conflict markers is replaced by the last good text, else the committed copy, else null. */
+function readPsycheFile(agentRoot, parts) {
+    const filePath = path.join(agentRoot, ...parts);
+    let text;
+    try {
+        text = String(fs.readFileSync(filePath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+    if (!hasConflictMarkers(text)) {
+        _lastGoodText.set(filePath, text);
+        _gitFallback.delete(filePath);
+        return text;
+    }
+    reportConflictMarkers(agentRoot, filePath, parts, text);
+    const lastGood = _lastGoodText.get(filePath);
+    if (lastGood !== undefined)
+        return lastGood;
+    const hash = (0, crypto_1.createHash)("sha256").update(text).digest("hex");
+    let remembered = _gitFallback.get(filePath);
+    if (remembered?.hash !== hash) {
+        remembered = { hash, committed: committedText(agentRoot, parts) };
+        _gitFallback.set(filePath, remembered);
+    }
+    const committed = remembered.committed;
+    if (committed === null || hasConflictMarkers(committed))
+        return null;
+    _lastGoodText.set(filePath, committed);
+    return committed;
+}
+/** Every file the psyche is built from, read once; null when a file is absent, unreadable or unusable. */
 function readPsycheSources(agentRoot) {
     const sources = {};
     for (const [key, parts] of Object.entries(PSYCHE_SOURCE_FILES)) {
-        try {
-            sources[key] = String(fs.readFileSync(path.join(agentRoot, ...parts), "utf-8"));
-        }
-        catch {
-            sources[key] = null;
-        }
+        sources[key] = readPsycheFile(agentRoot, parts);
     }
     return sources;
 }
@@ -165,6 +242,9 @@ function loadPsyche() {
 }
 function resetPsycheCache() {
     _psycheCache.clear();
+    _lastGoodText.clear();
+    _reportedMarkers.clear();
+    _gitFallback.clear();
 }
 const DEFAULT_ACTIVE_THRESHOLD_MS = 24 * 60 * 60 * 1000; // 24 hours
 function buildSessionSummary(options) {
@@ -321,19 +401,12 @@ the general flow when i see a non-empty bundleState:
      enumerates my PII payload (friends, Desk record, Arc, etc.), probes
      the remote for github public/private status, and returns a warning
      text i MUST show my friend verbatim. only after explicit confirmation
-     do i call \`bundle_push confirmation_token: ...\` with the token
-     the review returned.
-  6. if \`remote_push_failed\`: the remote advanced and my retry was
-     rejected too. use \`bundle_pull_rebase\` to pull down their changes
-     and rebase my commits on top.
-  7. if \`pull_rebase_conflict\`: the rebase left merge conflicts i need
-     to walk my friend through. read \`state/pending-sync.json\` to see
-     the conflictFiles array, then resolve each conflict in conversation
-     with them before re-running \`bundle_pull_rebase\`.
+     do i pass the token the review returned as \`confirmation_token\` to
+     \`bundle_push\` or \`bundle_pull_rebase\`.
 
-these tools refuse destructive operations by default and require an
-explicit force flag — that's the safety rail. i never pass force
-without asking my friend first.
+\`bundle_init_git\` and \`bundle_add_remote\` refuse to overwrite by
+default and require an explicit force flag — that's the safety rail. i
+never pass force without asking my friend first.
 
 ### peers — other agents on this machine
 

package/dist/repertoire/guardrails.js

@@ -33,12 +33,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OURO_CLI_TRUST_MANIFEST = exports.PSYCHE_REFUSAL = void 0;
+exports.BUNDLE_GIT_REFUSAL = exports.OURO_CLI_TRUST_MANIFEST = exports.PSYCHE_REFUSAL = void 0;
 exports.canonicalTarget = canonicalTarget;
 exports.insideAgentFolder = insideAgentFolder;
 exports.psycheFileClass = psycheFileClass;
 exports.psycheWriteAllowed = psycheWriteAllowed;
 exports.psycheEditNote = psycheEditNote;
+exports.bundleGitRefused = bundleGitRefused;
 exports.guardInvocation = guardInvocation;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
@@ -48,6 +49,7 @@ const shell_quote_1 = require("shell-quote");
 const runtime_1 = require("../nerves/runtime");
 const store_1 = require("../commerce/store");
 const identity_1 = require("../heart/identity");
+const sync_1 = require("../heart/sync");
 const deny = (reason) => ({ allowed: false, reason });
 const allow = { allowed: true };
 // --- reason templates ---
@@ -56,6 +58,7 @@ const REASONS = {
     readBeforeEdit: "i need to read that file first before i can edit it.",
     readBeforeOverwrite: "i need to read that file first before i can overwrite it.",
     protectedPath: "that path is protected — i can read it but not modify it.",
+    unreadablePath: "that path is protected — i can't read it.",
     destructiveCommand: "that command is too dangerous to run — it could cause irreversible damage.",
     // Trust reasons (vary by relationship)
     needsTrust: "i'd need a closer friend to vouch for you before i can do that.",
@@ -508,6 +511,10 @@ function checkProtectedPaths(toolName, args, context) {
             return deny(REASONS.protectedPath);
         if (productShellWriteRefused(command, context.agentRoot))
             return deny(REASONS.protectedPath);
+        if (bundleGitRefused(command, context.agentRoot))
+            return deny(exports.BUNDLE_GIT_REFUSAL);
+        if (syncSecretShellRefused(command))
+            return deny(REASONS.unreadablePath);
         if (shellWritesToProtectedPath(command))
             return deny(REASONS.protectedPath);
     }
@@ -1446,6 +1453,281 @@ function checkTrustLevelGuardrails(toolName, args, context) {
     }
     return checkWriteTrustGuardrails(toolName, args, context);
 }
+// --- git aimed at this agent's own bundle ---
+// Sync owns the bundle's repository: it commits, merges and pushes under its own lock. A git command from the shell that
+// works in the bundle, or points git at it, is refused. Every directory the command could be working in counts: where the
+// shell starts, each cd, pushd, env -C and git -C, and the --git-dir, --work-tree, GIT_DIR and GIT_WORK_TREE it names.
+// A git call whose directory the guard cannot work out (a variable, a glob, cd -) is refused too.
+exports.BUNDLE_GIT_REFUSAL = "my bundle syncs itself; I don't run git in it.";
+const GIT_PATH_VARIABLES = new Set(["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR"]);
+const GIT_GUARD_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+/** The commands a runner (xargs, find -exec, timeout) can start that the scan follows into. */
+const RUNNER_GIT_TARGETS = new Set(["git", "env", "eval", ...GIT_GUARD_SHELLS]);
+const DECLARATION_BUILTINS = new Set(["export", "declare", "typeset", "local", "readonly"]);
+// Commands that run another command given as their arguments; the guard looks for git (or a shell) among those arguments.
+const COMMAND_RUNNERS = new Set(["xargs", "find", "timeout", "nice", "ionice", "stdbuf", "setsid", "flock", "watch", "parallel", "doas", "chronic", "unbuffer", "chroot"]);
+/** git global options that take their value as the next word. */
+const GIT_VALUE_OPTIONS = new Set(["--namespace", "--exec-path", "--super-prefix", "--attr-source"]);
+function unknownShellWord(word) {
+    return word.includes(SHELL_PARAMETER_MARKER) || word.includes(SHELL_ARRAY_EXPANSION) || /[*?[\]{}]/.test(word);
+}
+function shellPathWord(word) {
+    return word === undefined || unknownShellWord(word) ? null : expandHome(word);
+}
+function noteGitAssignment(token, scan, known) {
+    const assignment = token.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s);
+    if (!assignment)
+        return false;
+    const [, name, value] = assignment;
+    if (GIT_PATH_VARIABLES.has(name))
+        scan.gitPaths.push(value);
+    if (/^GIT_CONFIG(?:_|$)/.test(name))
+        scan.configEnv = true;
+    if (name === "CDPATH")
+        scan.cdpath = true;
+    if (unknownShellWord(value))
+        known.delete(name);
+    else
+        known.set(name, value);
+    return true;
+}
+function scanShellForGit(command, scan, depth) {
+    if (depth >= 32) {
+        scan.opaqueShell = true;
+        return;
+    }
+    const parsed = parseShellCommands(executableShellView(command));
+    const known = new Map();
+    for (const name of STABLE_VARIABLES)
+        if (process.env[name])
+            known.set(name, process.env[name]);
+    for (const raw of parsed.commands) {
+        const tokens = raw.map((token) => resolveKnownShellParameters(token, known, parsed.parameterNames));
+        let index = 0;
+        while (index < tokens.length && noteGitAssignment(tokens[index], scan, known))
+            index += 1;
+        if (DECLARATION_BUILTINS.has(tokens[index] ?? "")) {
+            for (const token of tokens.slice(index + 1))
+                noteGitAssignment(token, scan, known);
+            continue;
+        }
+        if (index < tokens.length)
+            scanCommandForGit(tokens, index, scan, known, depth);
+    }
+}
+function scanCommandForGit(tokens, start, scan, known, depth) {
+    let index = start;
+    for (let hops = 0; hops <= tokens.length; hops += 1) {
+        const resolved = resolveShellCommand(tokens, index);
+        // A wrapper's own options: env -C and sudo --chdir change the directory, env NAME=value sets git's variables.
+        for (let k = index; k < resolved.index; k += 1) {
+            const word = tokens[k];
+            if (word === "-C" || word === "--chdir")
+                scan.cwdTargets.push(shellPathWord(tokens[k + 1]));
+            else if (word.startsWith("--chdir="))
+                scan.cwdTargets.push(shellPathWord(word.slice("--chdir=".length)));
+            else if (/^-C./.test(word))
+                scan.cwdTargets.push(shellPathWord(word.slice(2)));
+            else
+                noteGitAssignment(word, scan, known);
+        }
+        if (resolved.script !== undefined)
+            return scanShellForGit(resolved.script, scan, depth + 1);
+        index = resolved.index;
+        if (index >= tokens.length)
+            return;
+        // A command word the guard cannot read ($RUN git status) could be anything, git or a wrapper around it.
+        if (unknownShellWord(tokens[index])) {
+            if (tokens.slice(index).some((word) => /(?:^|\/)git$/.test(word)))
+                scan.opaqueShell = true;
+            return;
+        }
+        const executable = exactShellExecutable(tokens[index]);
+        if (executable === "git") {
+            scan.calls.push(tokens.slice(index + 1));
+            return;
+        }
+        if (executable === "cd" || executable === "pushd") {
+            const target = tokens.slice(index + 1).find((word) => !/^-[LPe@]+$/.test(word));
+            const viaCdpath = target !== undefined && scan.cdpath && !path.isAbsolute(expandHome(target));
+            scan.cwdTargets.push(target === undefined ? (executable === "cd" ? os.homedir() : null) : target === "-" || viaCdpath ? null : shellPathWord(target));
+            return;
+        }
+        if (GIT_GUARD_SHELLS.has(executable)) {
+            const option = tokens.findIndex((word, k) => k > index && /^-[^-]*c/.test(word));
+            if (option >= 0)
+                return scanShellForGit(tokens[option + 1] ?? "", scan, depth + 1);
+            if (tokens.slice(index + 1).every((word) => word.startsWith("-")))
+                scan.opaqueShell = true;
+            return;
+        }
+        if (executable === "eval")
+            return scanShellForGit(tokens.slice(index + 1).join(" "), scan, depth + 1);
+        if (!COMMAND_RUNNERS.has(executable))
+            return;
+        // find -execdir runs its command in each directory it finds.
+        if (executable === "find" && tokens.some((word, k) => k > index && (word === "-execdir" || word === "-okdir")))
+            scan.cwdTargets.push(null);
+        // xargs -I/-i/--replace puts its input into the command's words.
+        if (executable === "xargs" && tokens.some((word, k) => k > index && /^(?:-I|-i|--replace)/.test(word)))
+            scan.cwdTargets.push(null);
+        const next = tokens.findIndex((word, k) => k > index && RUNNER_GIT_TARGETS.has(exactShellExecutable(word)));
+        if (next < 0)
+            return;
+        index = next;
+    }
+}
+/** Where one git call works and what it names: its directories after -C, then --git-dir, --work-tree, and init or clone targets. Null when a word is unknown. */
+function gitCallPaths(args, cwds) {
+    let dirs = [...cwds];
+    const named = [];
+    let index = 0;
+    const value = (word) => shellPathWord(word);
+    while (index < args.length) {
+        const word = args[index];
+        if (word === "-C") {
+            const dir = value(args[index + 1]);
+            if (dir === null)
+                return null;
+            dirs = dirs.map((cwd) => path.isAbsolute(dir) ? dir : cwd === null ? null : path.resolve(cwd, dir));
+            index += 2;
+            continue;
+        }
+        if (word === "--git-dir" || word === "--work-tree") {
+            const dir = value(args[index + 1]);
+            if (dir === null)
+                return null;
+            named.push(dir);
+            index += 2;
+            continue;
+        }
+        if (word.startsWith("--git-dir=") || word.startsWith("--work-tree=")) {
+            const dir = value(word.slice(word.indexOf("=") + 1));
+            if (dir === null)
+                return null;
+            named.push(dir);
+            index += 1;
+            continue;
+        }
+        if (word === "-c") {
+            const setting = args[index + 1] ?? "";
+            // An alias can run any command, git in any directory included.
+            if (/^alias\./i.test(setting))
+                return null;
+            const worktree = setting.match(/^core\.worktree=(.*)$/is);
+            if (worktree) {
+                const dir = value(worktree[1]);
+                if (dir === null)
+                    return null;
+                named.push(dir);
+            }
+            index += 2;
+            continue;
+        }
+        if (word === "--config-env" || word.startsWith("--config-env="))
+            return null;
+        if (GIT_VALUE_OPTIONS.has(word)) {
+            index += 2;
+            continue;
+        }
+        if (word.startsWith("-")) {
+            index += 1;
+            continue;
+        }
+        // The subcommand. init and clone also name a directory to create or fill.
+        const positional = args.slice(index + 1).filter((arg) => !arg.startsWith("-"));
+        const separate = args.slice(index + 1).flatMap((arg, k, rest) => arg === "--separate-git-dir" ? [rest[k + 1]] : arg.startsWith("--separate-git-dir=") ? [arg.slice("--separate-git-dir=".length)] : []);
+        const targets = word === "init" ? [...positional.slice(-1), ...separate] : word === "clone" && positional.length >= 2 ? [...positional.slice(-1), ...separate] : [];
+        for (const target of targets) {
+            const dir = value(target);
+            if (dir === null)
+                return null;
+            named.push(dir);
+        }
+        break;
+    }
+    if (dirs.some((dir) => dir === null))
+        return null;
+    const known = dirs;
+    return [...known, ...named.flatMap((dir) => path.isAbsolute(dir) ? [dir] : known.map((cwd) => path.resolve(cwd, dir)))];
+}
+/** Whether a shell command could run git in the agent's bundle. Exported for tests. */
+function bundleGitRefused(command, agentRoot) {
+    // Quotes and backslashes can split the word (g''it, "g"it, g\it); the shell joins it back.
+    const plain = command.replace(/['"\\]/g, "");
+    if (!agentRoot || !plain.includes("git"))
+        return false;
+    try {
+        const scan = { cwdTargets: [], gitPaths: [], calls: [], opaqueShell: false, configEnv: false, cdpath: !!process.env.CDPATH };
+        scanShellForGit(command, scan, 0);
+        if (scan.opaqueShell && /(?:^|[^A-Za-z0-9_-])git(?:$|[^A-Za-z0-9_-])/.test(plain))
+            return true;
+        if (scan.calls.length === 0)
+            return false;
+        // Every directory the command could be working in: where the shell starts, and each change, from each earlier one.
+        const cwds = [process.cwd()];
+        for (const target of scan.cwdTargets) {
+            if (target === null)
+                cwds.push(null);
+            else
+                cwds.push(...(path.isAbsolute(target) ? [target] : cwds.map((cwd) => cwd === null ? null : path.resolve(cwd, target))));
+        }
+        const roots = [path.resolve(agentRoot), canonicalize(path.resolve(agentRoot))];
+        // git config from the environment can hide a git aimed at the bundle in an alias: refuse it when the command names the bundle.
+        if (scan.configEnv && [...roots, path.basename(agentRoot)].some((root) => plain.includes(root)))
+            return true;
+        const inBundle = (target) => [target, canonicalize(target)].some((form) => roots.some((root) => form === root || form.startsWith(`${root}${path.sep}`)));
+        for (const call of scan.calls) {
+            const paths = gitCallPaths(call, cwds);
+            if (paths === null)
+                return true;
+            const variables = scan.gitPaths.map((value) => shellPathWord(value));
+            if (variables.some((value) => value === null))
+                return true;
+            const bases = paths.slice(0, cwds.length);
+            const named = variables.flatMap((value) => path.isAbsolute(value) ? [value] : bases.map((base) => path.resolve(base, value)));
+            if ([...paths, ...named].some(inBundle))
+                return true;
+        }
+        return false;
+    }
+    catch {
+        // The command could not be parsed, or the filesystem could not say where a path lands: refuse rather than guess.
+        return true;
+    }
+}
+// --- the sync key's directory, closed to the read-only file tools ---
+/** The directories read_file, glob and grep would read for these arguments, as the tools resolve them. */
+function readToolTargets(toolName, args) {
+    const local = (p) => path.isAbsolute(p) ? p : path.resolve((0, identity_1.getRepoRoot)(), p);
+    if (toolName === "read_file")
+        return [{ target: local(args.path ?? ""), recursive: false }];
+    if (toolName === "grep")
+        return [{ target: local(args.path ?? ""), recursive: true }];
+    const cwd = args.cwd ? local(args.cwd) : process.cwd();
+    // The part of the pattern before its first glob segment is a directory the glob reads.
+    const segments = (args.pattern ?? "").split("/");
+    const firstGlob = segments.findIndex((segment) => /[*?[\]{}()!]/.test(segment));
+    const literal = (firstGlob < 0 ? segments : segments.slice(0, firstGlob)).join("/");
+    return [{ target: cwd, recursive: false }, { target: path.resolve(cwd, literal || "."), recursive: false }];
+}
+function syncSecretReadRefused(toolName, args) {
+    try {
+        const lexical = path.resolve((0, sync_1.syncSecretDir)());
+        const secrets = [lexical, canonicalize(lexical)];
+        return readToolTargets(toolName, args).some(({ target, recursive }) => [target, canonicalize(target)].some((form) => secrets.some((secret) => form === secret || form.startsWith(`${secret}${path.sep}`) || (recursive && (form === path.parse(form).root || secret.startsWith(`${form}${path.sep}`))))));
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * A shell command that names the key's directory. The agent's uid cannot read
+ * the key; this only turns an accidental attempt into a plain refusal.
+ */
+function syncSecretShellRefused(command) {
+    return command.includes(path.resolve((0, sync_1.syncSecretDir)()));
+}
 // --- main entry point ---
 function guardInvocation(toolName, args, context) {
     (0, runtime_1.emitNervesEvent)({
@@ -1454,9 +1736,9 @@ function guardInvocation(toolName, args, context) {
         message: "guardrail check",
         meta: { toolName },
     });
-    // Read-only tools are always allowed (no structural or trust guardrails)
+    // Read-only tools skip the structural and trust guardrails; only the sync key's directory is closed to them.
     if (READ_ONLY_TOOLS.has(toolName))
-        return allow;
+        return syncSecretReadRefused(toolName, args) ? deny(REASONS.unreadablePath) : allow;
     // Layer 1: structural guardrails (always on)
     const structuralResult = checkStructuralGuardrails(toolName, args, context);
     if (!structuralResult.allowed)