@coreplane/switchboard 1.212.0 → 1.213.0

package/README.md

@@ -10,7 +10,7 @@
 Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.
 
 <p align="center">
-  <img alt="A review in a Slack thread: the mention, the status card ticking through the run's steps, then the verdict with its findings." src="https://raw.githubusercontent.com/coreplanelabs/switchboard/HEAD/docs/public/slack/run.gif" width="395">
+  <img alt="A review in a Slack thread: a plain request to look at a pull request, the card naming the agent it picked and why, then the verdict with its findings." src="https://raw.githubusercontent.com/coreplanelabs/switchboard/HEAD/docs/public/slack/run.gif" width="395">
 </p>
 
 <picture>
@@ -33,7 +33,7 @@ Next: [Get started](https://github.com/coreplanelabs/switchboard/blob/HEAD/docs/
 
 ## How it is put together
 
-Four seams: Channel, Provider, Executor, Agent. Each is an interface with more than one implementation. The dispatcher sits between them: directives, config layers, authorization, the agent loop ([How a request flows](https://github.com/coreplanelabs/switchboard/blob/HEAD/docs/explanation/how-a-request-flows.md)).
+Four seams: Channel, Provider, Executor, Agent. Each is an interface with more than one implementation. The dispatcher sits between them: it reads what you asked for and picks the agent, resolves the model through the config layers, checks authorization and runs the agent loop ([How a request flows](https://github.com/coreplanelabs/switchboard/blob/HEAD/docs/explanation/how-a-request-flows.md)).
 
 
 ## What you need
@@ -47,8 +47,10 @@ Four seams: Channel, Provider, Executor, Agent. Each is an interface with more t
 | Optional | An E2B account | Per-thread micro-VMs without Cloudflare |
 | Optional | A Brave Search key (`BRAVE_SEARCH_API_KEY`) | Web search for the research agent |
 
-Off means absent from `help`, the dashboard and the plan ([Turn features on and off](https://github.com/coreplanelabs/switchboard/blob/HEAD/docs/how-to/turn-features-on-and-off.md)). The bot is `npx @coreplane/switchboard start` on any machine with Node, or the published image `ghcr.io/coreplanelabs/switchboard`.
+Off means the bot never offers it and the dashboard and the plan never show it ([Turn features on and off](https://github.com/coreplanelabs/switchboard/blob/HEAD/docs/how-to/turn-features-on-and-off.md)). The bot is `npx @coreplane/switchboard start` on any machine with Node, or the published image `ghcr.io/coreplanelabs/switchboard`.
 
 ## Learn more
 
 Docs: <https://openswitchboard.dev> ([`docs/`](https://github.com/coreplanelabs/switchboard/blob/HEAD/docs/README.md)) · [CONTRIBUTING.md](https://github.com/coreplanelabs/switchboard/blob/HEAD/CONTRIBUTING.md) · [AGENTS.md](https://github.com/coreplanelabs/switchboard/blob/HEAD/AGENTS.md) · [SECURITY.md](https://github.com/coreplanelabs/switchboard/blob/HEAD/SECURITY.md) · [Apache-2.0](https://github.com/coreplanelabs/switchboard/blob/HEAD/LICENSE).
+
+Going deeper: commands and directives exist for whoever wants to type them ([Slack commands](https://github.com/coreplanelabs/switchboard/blob/HEAD/docs/reference/slack-commands.md)); a plain sentence needs none.

package/dist/assets/config/config.example.yaml

@@ -212,6 +212,27 @@ execution:
 # Under docker compose this directory is a named volume, so checkouts survive a restart.
 workspaceDir: ./workspaces
 
+# The artifact store (docs/reference/specs/execution.md item 20): one private R2
+# bucket a run's files move through by reference — a screenshot a coding run
+# attaches, a video a person drops on a thread. DEFAULT OFF: absent means no
+# store; attach_file keeps its inline path (10 MiB cap) and an inbound video is
+# skipped with its name, exactly as before. Configured, the bot signs presigned
+# URLs and the container moves the bytes; the bot never holds a file. Needs
+# three bot secrets — ARTIFACTS_R2_ACCESS_KEY_ID and ARTIFACTS_R2_SECRET_ACCESS_KEY
+# (an R2 API token scoped Object Read & Write to this bucket only) and
+# ARTIFACTS_COPY_TOKEN (self-minted, shared with the bot's own Worker) — and
+# PUBLIC_BASE_URL; a configured store with any of them unset fails startup by
+# name. `deploy` creates the bucket; `artifacts lifecycle` applies retention;
+# `artifacts check` reads whether the bucket is private.
+# artifacts:
+#   r2:
+#     accountId: <your Cloudflare account id>     # the S3 endpoint is <accountId>.r2.cloudflarestorage.com
+#     bucket: switchboard-artifacts                 # the bot's Worker binds the same name
+#   retentionDays: 30       # objects expire after this many days (default 30)
+#   inbound:
+#     maxBytesPerMessage: 2147483648   # the most staged bytes one message may carry (default 2 GiB)
+#     copyTimeoutMs: 1200000           # how long the bot waits on one inbound copy (default 20 min)
+
 # Cross-session self-learning memory (docs/reference/specs/memory.md). DEFAULT OFF: absent, or
 # enabled:false, means the dispatcher uses a NullMemoryStore and the model input
 # is byte-identical to memory-off — zero behavior change. When enabled, before
@@ -293,6 +314,18 @@ workspaceDir: ./workspaces
 #   maxRounds: 3      # review rounds per unit
 #   maxMinutes: 120   # the ship preset's wall-clock budget in minutes (the registry's default)
 
+# Which loop drives each preset's runs (docs/reference/specs/harness-pi.md):
+# `native`, the in-process turn loop, or `pi`, the pi coding agent started
+# inside the run's own execution container and driven over its RPC protocol —
+# with the run's model-proxy bearer as its only key, every event bridged onto
+# the run's own record, our tools and tool rules as its extension. Every
+# preset declares `native` until the pi series moves it; a deployment moves a
+# preset early here. Only a preset with a workspace (coding, review, explore)
+# can run on pi. A preset the registry does not know, or a value that is
+# neither harness, fails the load by name.
+# harness:
+#   coding: pi
+
 # The fan-out cap a spawning run meets (docs/reference/specs/agent-conductor.md).
 # `agent:conductor` starts child runs as the person who asked — each an
 # ordinary run in a thread of its own, under that person's permissions — and
@@ -302,6 +335,17 @@ workspaceDir: ./workspaces
 # spawn:
 #   maxChildren: 3
 
+# The request router (docs/reference/specs/routing-and-config.md item 21). ON BY
+# DEFAULT: a plain message — no `agent:` directive, no sticky preset, no channel
+# or user `agent` — asks the fast model which preset it means and runs as that
+# preset, the card saying why (`routed: <reason>`) and how to run it another way.
+# `ship` is never routed. The one way off, so every plain message runs
+# `defaults.agent` as before the router: `auto: false`. `model` is the router's
+# model; default `defaults.models.general`.
+# routing:
+#   auto: false
+#   model: anthropic/claude-haiku-4-5
+
 # Spend reporting: GET /costs (Access-gated). Optional. See docs/reference/specs/costs.md.
 # costs:
 #   cloudflareAccountId: <32-hex account id>

package/dist/assets/deploy/cloudflare/worker.ts

@@ -90,6 +90,9 @@ export interface Env {
   MEMORY_TOKEN?: string; // durable memory + friction ledger + schedule firings + MCP registry: bearer for the state Worker
   MCP_CREDENTIAL_KEY?: string; // MCP registry: the bot-only key that seals server credentials before they reach the McpDO
   STATE_WORKER_URL?: string; // var: the state Worker's base URL — where this shim records each scheduled firing
+  ARTIFACTS_R2_ACCESS_KEY_ID?: string; // artifact store: the bucket-scoped S3 token the bot signs presigned URLs with
+  ARTIFACTS_R2_SECRET_ACCESS_KEY?: string; // artifact store: the secret half of that token
+  ARTIFACTS_COPY_TOKEN?: string; // artifact store: the bearer the bot presents to this Worker's /artifacts/copy route
 }
 
 /** Every secret/var the Worker forwards into the container. Optional entries
@@ -115,6 +118,9 @@ const FORWARDED_OPTIONAL = [
   "MEMORY_TOKEN",
   "MCP_CREDENTIAL_KEY",
   "STATE_WORKER_URL",
+  "ARTIFACTS_R2_ACCESS_KEY_ID",
+  "ARTIFACTS_R2_SECRET_ACCESS_KEY",
+  "ARTIFACTS_COPY_TOKEN",
 ] as const satisfies readonly (keyof Env)[];
 
 /** The container's environment, computed from the Worker env AT START TIME.

package/dist/assets/deploy/cloudflare-resident/Dockerfile

@@ -153,6 +153,24 @@ RUN apt-get update \
   && playwright screenshot --viewport-size=640,480 'data:text/html,<h1>ok</h1>' /tmp/ok.png && test -s /tmp/ok.png \
   && rm -f /tmp/proof.mp4 /tmp/proof_*.png /tmp/ok.png
 
+# pi — the coding harness the bot can start INSIDE this container in place of
+# its native turn loop (docs/reference/specs/harness-pi.md): `pi --mode rpc`,
+# one process per run in the thread's worktree, driven by the bot over its
+# JSONL protocol, with the run's model-proxy bearer as its only key (never a
+# model key: the bearer buys calls through the bot, docs/reference/specs/
+# model-proxy.md). Installed globally with this image's Node — pi needs
+# >= 22.19.0 and the image ships 24 — so every user finds it on PATH, at an
+# EXACT pin held by src/deploy/imagePiHarness.test.ts (the pnpm lesson: a
+# floating tag would move the harness's protocol with the build date, and a
+# pi minor changes RPC events and extension hooks). Proven by the layer, so
+# the BUILD fails, not a run: the pi on PATH answers the pin, and its own help
+# names the RPC mode the harness drives. Dark until a deployment sets
+# `harness: { coding: pi }`: nothing here starts pi on its own.
+RUN npm install -g @earendil-works/pi-coding-agent@0.85.1 \
+  && npm cache clean --force \
+  && pi --version | grep -qx '0.85.1' \
+  && pi --help | grep -q -- '--mode <mode>'
+
 # Agent commands never run as root (repo code runs unprivileged, one user per
 # thread — docs/reference/specs/resident-repos.md). The SDK's exec has no user/uid option
 # (verified against 0.13.0-next.751.1), so the container server itself runs as
@@ -175,3 +193,9 @@ RUN set -eux; \
 # browser tree under /opt and launch it, so the BUILD fails if a chmod or the
 # path ever regresses, not a run.
 RUN su -s /bin/bash worker1 -c "playwright screenshot --viewport-size=640,480 'data:text/html,<h1>ok</h1>' /tmp/ok.png && test -s /tmp/ok.png && rm -f /tmp/ok.png"
+
+# pi once more, as worker1: a run's pi is started as the thread's user through
+# the same `su`, so the BUILD proves an unprivileged user finds the pin on PATH
+# and pi answers without a writable home (its config directory is the run's
+# own, named by PI_CODING_AGENT_DIR at start).
+RUN su -s /bin/bash worker1 -c "pi --version | grep -qx '0.85.1'"